# Flog Txt Version 1 # Analyzer Version: 4.5.0 # Analyzer Build Date: Apr 22 2022 21:04:16 # Log Creation Date: 04.05.2022 13:14:09.640 Process: id = "1" image_name = "31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe" page_root = "0x6cc68000" os_pid = "0x76c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x78c" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fe14" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 121 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 122 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 123 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 124 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 125 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 126 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 127 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 128 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 129 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 130 start_va = 0x400000 end_va = 0x4adfff monitored = 1 entry_point = 0x4a5d3a region_type = mapped_file name = "31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe") Region: id = 131 start_va = 0x77830000 end_va = 0x779aafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 132 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 133 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 134 start_va = 0x7fff0000 end_va = 0x7ffdab58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 135 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 136 start_va = 0x7ffdab751000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffdab751000" filename = "" Region: id = 275 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 276 start_va = 0x639e0000 end_va = 0x63a2ffff monitored = 0 entry_point = 0x639f8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 277 start_va = 0x63a40000 end_va = 0x63ab9fff monitored = 0 entry_point = 0x63a53290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 278 start_va = 0x74580000 end_va = 0x7465ffff monitored = 0 entry_point = 0x74593980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 279 start_va = 0x63a30000 end_va = 0x63a37fff monitored = 0 entry_point = 0x63a317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 280 start_va = 0x680000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 281 start_va = 0x6cd80000 end_va = 0x6cdd8fff monitored = 1 entry_point = 0x6cd90780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 282 start_va = 0x74580000 end_va = 0x7465ffff monitored = 0 entry_point = 0x74593980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 283 start_va = 0x77420000 end_va = 0x7759dfff monitored = 0 entry_point = 0x774d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 284 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 285 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 286 start_va = 0x4b0000 end_va = 0x56dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 287 start_va = 0x8c0000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 288 start_va = 0x744b0000 end_va = 0x74541fff monitored = 0 entry_point = 0x744f0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 289 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 290 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 291 start_va = 0x74810000 end_va = 0x7488afff monitored = 0 entry_point = 0x7482e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 292 start_va = 0x74db0000 end_va = 0x74e6dfff monitored = 0 entry_point = 0x74de5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 293 start_va = 0x570000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 294 start_va = 0x680000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 295 start_va = 0x7c0000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 296 start_va = 0x757e0000 end_va = 0x75823fff monitored = 0 entry_point = 0x757f9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 297 start_va = 0x759b0000 end_va = 0x75a5cfff monitored = 0 entry_point = 0x759c4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 298 start_va = 0x74560000 end_va = 0x7457dfff monitored = 0 entry_point = 0x7456b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 299 start_va = 0x74550000 end_va = 0x74559fff monitored = 0 entry_point = 0x74552a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 300 start_va = 0x777d0000 end_va = 0x77827fff monitored = 0 entry_point = 0x778125c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 301 start_va = 0x8c0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 302 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 303 start_va = 0x6cd00000 end_va = 0x6cd78fff monitored = 1 entry_point = 0x6cd0f82a region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 304 start_va = 0x77680000 end_va = 0x776c4fff monitored = 0 entry_point = 0x7769de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 305 start_va = 0x75bf0000 end_va = 0x75dacfff monitored = 0 entry_point = 0x75cd2a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 306 start_va = 0x771b0000 end_va = 0x772fefff monitored = 0 entry_point = 0x77266820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 307 start_va = 0x75640000 end_va = 0x75786fff monitored = 0 entry_point = 0x75651cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 308 start_va = 0x1d0000 end_va = 0x1f9fff monitored = 0 entry_point = 0x1d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 309 start_va = 0xa10000 end_va = 0xb97fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a10000" filename = "" Region: id = 310 start_va = 0x77740000 end_va = 0x7776afff monitored = 0 entry_point = 0x77745680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 311 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 312 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 313 start_va = 0x5b0000 end_va = 0x658fff monitored = 1 entry_point = 0x655d3a region_type = mapped_file name = "31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe") Region: id = 314 start_va = 0xba0000 end_va = 0xd20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ba0000" filename = "" Region: id = 315 start_va = 0xd30000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d30000" filename = "" Region: id = 316 start_va = 0x77730000 end_va = 0x7773bfff monitored = 0 entry_point = 0x77733930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 317 start_va = 0x6d230000 end_va = 0x6d237fff monitored = 0 entry_point = 0x6d2317b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 318 start_va = 0x6b220000 end_va = 0x6b8d0fff monitored = 1 entry_point = 0x6b235d20 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 319 start_va = 0x6cc00000 end_va = 0x6ccf4fff monitored = 0 entry_point = 0x6cc54160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 320 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 321 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 322 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 323 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 324 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 325 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 326 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 327 start_va = 0x600000 end_va = 0x600fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 328 start_va = 0x610000 end_va = 0x610fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 329 start_va = 0x8c0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 330 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 331 start_va = 0x8c0000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 332 start_va = 0x9c0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 333 start_va = 0x620000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 334 start_va = 0x2130000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 335 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 336 start_va = 0x2230000 end_va = 0x422ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 337 start_va = 0x8c0000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 338 start_va = 0x960000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 339 start_va = 0x780000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 340 start_va = 0x4230000 end_va = 0x432ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004230000" filename = "" Region: id = 341 start_va = 0x4330000 end_va = 0x4666fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 342 start_va = 0x69ff0000 end_va = 0x6b217fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll") Region: id = 343 start_va = 0x753d0000 end_va = 0x754bafff monitored = 0 entry_point = 0x7540d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 344 start_va = 0x4670000 end_va = 0x4700fff monitored = 0 entry_point = 0x46a8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 345 start_va = 0x70610000 end_va = 0x70684fff monitored = 0 entry_point = 0x70649a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 346 start_va = 0x4670000 end_va = 0x47affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004670000" filename = "" Region: id = 347 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 348 start_va = 0x6cb80000 end_va = 0x6cbfdfff monitored = 1 entry_point = 0x6cb81140 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 349 start_va = 0x74660000 end_va = 0x746f1fff monitored = 0 entry_point = 0x74698cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 350 start_va = 0x970000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 351 start_va = 0x6bba0000 end_va = 0x6c54bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll") Region: id = 352 start_va = 0x6c9c0000 end_va = 0x6cb4cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\system.drawing.ni.dll") Region: id = 353 start_va = 0x69390000 end_va = 0x69fe8fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8cd2187094ba6cade0ca0fab4f932654\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\8cd2187094ba6cade0ca0fab4f932654\\system.windows.forms.ni.dll") Region: id = 354 start_va = 0x980000 end_va = 0x980fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 355 start_va = 0x980000 end_va = 0x981fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 356 start_va = 0x5e430000 end_va = 0x5e4cbfff monitored = 1 entry_point = 0x5e4be9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 357 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 358 start_va = 0x4670000 end_va = 0x470bfff monitored = 1 entry_point = 0x46fe9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 359 start_va = 0x47a0000 end_va = 0x47affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047a0000" filename = "" Region: id = 360 start_va = 0x4710000 end_va = 0x479efff monitored = 0 entry_point = 0x471dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 361 start_va = 0x6c920000 end_va = 0x6c9b1fff monitored = 0 entry_point = 0x6c92dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 362 start_va = 0x47b0000 end_va = 0x48cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 363 start_va = 0x9a0000 end_va = 0x9a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 364 start_va = 0x47b0000 end_va = 0x486bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000047b0000" filename = "" Region: id = 365 start_va = 0x48c0000 end_va = 0x48cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048c0000" filename = "" Region: id = 366 start_va = 0x9a0000 end_va = 0x9a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 367 start_va = 0x9b0000 end_va = 0x9b3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 368 start_va = 0x48d0000 end_va = 0x4adafff monitored = 0 entry_point = 0x497b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 369 start_va = 0x6f0a0000 end_va = 0x6f2aefff monitored = 0 entry_point = 0x6f14b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 370 start_va = 0x9d0000 end_va = 0x9d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 371 start_va = 0x9f0000 end_va = 0x9f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009f0000" filename = "" Region: id = 372 start_va = 0x48d0000 end_va = 0x4aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 373 start_va = 0x6fef0000 end_va = 0x6ff0cfff monitored = 0 entry_point = 0x6fef3b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 374 start_va = 0x9d0000 end_va = 0x9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 375 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 376 start_va = 0x6c7b0000 end_va = 0x6c91afff monitored = 0 entry_point = 0x6c81e360 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll") Region: id = 377 start_va = 0x48d0000 end_va = 0x4a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 378 start_va = 0x4aa0000 end_va = 0x4aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004aa0000" filename = "" Region: id = 379 start_va = 0x4710000 end_va = 0x474ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 380 start_va = 0x48d0000 end_va = 0x49cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 381 start_va = 0x4a10000 end_va = 0x4a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a10000" filename = "" Region: id = 382 start_va = 0x6d490000 end_va = 0x6d680fff monitored = 0 entry_point = 0x6d573cd0 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll") Region: id = 383 start_va = 0x75a70000 end_va = 0x75b8efff monitored = 0 entry_point = 0x75ab5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 384 start_va = 0x4750000 end_va = 0x4798fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 385 start_va = 0x9d0000 end_va = 0x9d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 386 start_va = 0x4ab0000 end_va = 0x5aaffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 387 start_va = 0x4870000 end_va = 0x4873fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004870000" filename = "" Region: id = 388 start_va = 0x5ab0000 end_va = 0x5baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ab0000" filename = "" Region: id = 389 start_va = 0x5bb0000 end_va = 0x5caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005bb0000" filename = "" Region: id = 390 start_va = 0x5cb0000 end_va = 0x61a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005cb0000" filename = "" Region: id = 391 start_va = 0x61b0000 end_va = 0x626cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 392 start_va = 0x6270000 end_va = 0x666ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006270000" filename = "" Region: id = 393 start_va = 0x6670000 end_va = 0x76affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 394 start_va = 0x4880000 end_va = 0x4880fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 395 start_va = 0x4a20000 end_va = 0x4a81fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 396 start_va = 0x4890000 end_va = 0x489ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 397 start_va = 0x48a0000 end_va = 0x48affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048a0000" filename = "" Region: id = 398 start_va = 0x48b0000 end_va = 0x48bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 399 start_va = 0x4890000 end_va = 0x48a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004890000" filename = "" Region: id = 400 start_va = 0x48b0000 end_va = 0x48bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 401 start_va = 0x49d0000 end_va = 0x49dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049d0000" filename = "" Region: id = 402 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 403 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 404 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 405 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 406 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 407 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 408 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 409 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 410 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 411 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 412 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 413 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 414 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 415 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 416 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 417 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 418 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 419 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 420 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 421 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 422 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 423 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 424 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 425 start_va = 0x4a00000 end_va = 0x4a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 426 start_va = 0x4a00000 end_va = 0x4a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 427 start_va = 0x4a90000 end_va = 0x4a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a90000" filename = "" Region: id = 428 start_va = 0x4a90000 end_va = 0x4a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a90000" filename = "" Region: id = 429 start_va = 0x76b0000 end_va = 0x76bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076b0000" filename = "" Region: id = 430 start_va = 0x76b0000 end_va = 0x76bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076b0000" filename = "" Region: id = 431 start_va = 0x76b0000 end_va = 0x76bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076b0000" filename = "" Region: id = 432 start_va = 0x76c0000 end_va = 0x76cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076c0000" filename = "" Region: id = 433 start_va = 0x76c0000 end_va = 0x76cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076c0000" filename = "" Region: id = 434 start_va = 0x76d0000 end_va = 0x76dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076d0000" filename = "" Region: id = 435 start_va = 0x76e0000 end_va = 0x76effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076e0000" filename = "" Region: id = 436 start_va = 0x76f0000 end_va = 0x76fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076f0000" filename = "" Region: id = 437 start_va = 0x7700000 end_va = 0x770ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007700000" filename = "" Region: id = 438 start_va = 0x7710000 end_va = 0x771ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007710000" filename = "" Region: id = 439 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 440 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 441 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 442 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 443 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 444 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 445 start_va = 0x4a00000 end_va = 0x4a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 446 start_va = 0x76b0000 end_va = 0x76effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076b0000" filename = "" Region: id = 447 start_va = 0x76f0000 end_va = 0x77effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076f0000" filename = "" Region: id = 448 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 449 start_va = 0x77f0000 end_va = 0x782ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000077f0000" filename = "" Region: id = 450 start_va = 0x7830000 end_va = 0x792ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007830000" filename = "" Region: id = 451 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 452 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 453 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 454 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 455 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 456 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 457 start_va = 0x6b0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 458 start_va = 0x6c0000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 459 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 460 start_va = 0x6e0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006e0000" filename = "" Region: id = 461 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 462 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 463 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 464 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 465 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 466 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 467 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 468 start_va = 0x68c70000 end_va = 0x69381fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll") Region: id = 469 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 470 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 471 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 472 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 473 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 474 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 475 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 476 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 477 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 478 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 479 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 480 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 481 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 482 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 483 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 484 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 485 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 486 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 487 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 488 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 489 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 490 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 491 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 492 start_va = 0x70410000 end_va = 0x70422fff monitored = 0 entry_point = 0x70419950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 493 start_va = 0x680000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 494 start_va = 0x7930000 end_va = 0x7a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007930000" filename = "" Region: id = 495 start_va = 0x703e0000 end_va = 0x7040efff monitored = 0 entry_point = 0x703f95e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 496 start_va = 0x74200000 end_va = 0x7421afff monitored = 0 entry_point = 0x74209050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 497 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 498 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 499 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 500 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 501 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 502 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 503 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 504 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 505 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 506 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 507 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 508 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 509 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 510 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 511 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 512 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 513 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 514 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 515 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 516 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 517 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 518 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 519 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 520 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 521 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 522 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 523 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 524 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 525 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 526 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 527 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 528 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 529 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 530 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 531 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 532 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 533 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 534 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 535 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 536 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 537 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 538 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 539 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 540 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 541 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 542 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 543 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 544 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 545 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 546 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 547 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 548 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 549 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 550 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 551 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 552 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 553 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 554 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 555 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 556 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 557 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 558 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 559 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 560 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 561 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 562 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 563 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 564 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 565 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 566 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 567 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 568 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 569 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 570 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 571 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 572 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 573 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 574 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 575 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 576 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 577 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 578 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 579 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 580 start_va = 0x6c0000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 581 start_va = 0x7a30000 end_va = 0x7ac6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a30000" filename = "" Region: id = 582 start_va = 0x6ba20000 end_va = 0x6bb92fff monitored = 0 entry_point = 0x6bacd220 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 583 start_va = 0x7ad0000 end_va = 0x7b65fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ad0000" filename = "" Region: id = 584 start_va = 0x740000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 585 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 586 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 587 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 588 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 589 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 590 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 591 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 592 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 593 start_va = 0x7b70000 end_va = 0x7c04fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007b70000" filename = "" Region: id = 594 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 595 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 596 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 597 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 598 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 599 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 600 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 601 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 602 start_va = 0x4a00000 end_va = 0x4a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 603 start_va = 0x4a90000 end_va = 0x4a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a90000" filename = "" Region: id = 604 start_va = 0x7c10000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 605 start_va = 0x7c20000 end_va = 0x7c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c20000" filename = "" Region: id = 606 start_va = 0x7c30000 end_va = 0x7c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c30000" filename = "" Region: id = 607 start_va = 0x7c40000 end_va = 0x7c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c40000" filename = "" Region: id = 608 start_va = 0x7c50000 end_va = 0x7c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 609 start_va = 0x7c60000 end_va = 0x7c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 610 start_va = 0x7c70000 end_va = 0x7c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 611 start_va = 0x7c80000 end_va = 0x7c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c80000" filename = "" Region: id = 612 start_va = 0x7c90000 end_va = 0x7c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c90000" filename = "" Region: id = 613 start_va = 0x7ca0000 end_va = 0x7caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ca0000" filename = "" Region: id = 614 start_va = 0x7cb0000 end_va = 0x7cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cb0000" filename = "" Region: id = 615 start_va = 0x7cc0000 end_va = 0x7ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cc0000" filename = "" Region: id = 616 start_va = 0x7cd0000 end_va = 0x7cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cd0000" filename = "" Region: id = 617 start_va = 0x7ce0000 end_va = 0x7ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 618 start_va = 0x7cf0000 end_va = 0x7cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cf0000" filename = "" Region: id = 619 start_va = 0x7d00000 end_va = 0x7d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d00000" filename = "" Region: id = 620 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 621 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 622 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 623 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 624 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 625 start_va = 0x49e0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049e0000" filename = "" Region: id = 626 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 627 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 628 start_va = 0x4a00000 end_va = 0x4a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 629 start_va = 0x7c10000 end_va = 0x7c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 630 start_va = 0x7d10000 end_va = 0x7e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 631 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 632 start_va = 0x7e10000 end_va = 0x7f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e10000" filename = "" Region: id = 633 start_va = 0x6b900000 end_va = 0x6ba1bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\d2f554a0c84513cd793fdcd77a86dab1\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\d2f554a0c84513cd793fdcd77a86dab1\\system.management.ni.dll") Region: id = 634 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 635 start_va = 0x4a00000 end_va = 0x4a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 636 start_va = 0x4a90000 end_va = 0x4a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a90000" filename = "" Region: id = 637 start_va = 0x7c50000 end_va = 0x7c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 638 start_va = 0x7c60000 end_va = 0x7c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c60000" filename = "" Region: id = 639 start_va = 0x7c70000 end_va = 0x7c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 640 start_va = 0x7c80000 end_va = 0x7c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c80000" filename = "" Region: id = 641 start_va = 0x7c90000 end_va = 0x7c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c90000" filename = "" Region: id = 642 start_va = 0x7ca0000 end_va = 0x7caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ca0000" filename = "" Region: id = 643 start_va = 0x7cb0000 end_va = 0x7cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cb0000" filename = "" Region: id = 644 start_va = 0x7cc0000 end_va = 0x7ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cc0000" filename = "" Region: id = 645 start_va = 0x7cd0000 end_va = 0x7cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cd0000" filename = "" Region: id = 646 start_va = 0x7ce0000 end_va = 0x7ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 647 start_va = 0x7cf0000 end_va = 0x7cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cf0000" filename = "" Region: id = 648 start_va = 0x7f10000 end_va = 0x7f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f10000" filename = "" Region: id = 649 start_va = 0x7f20000 end_va = 0x7f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f20000" filename = "" Region: id = 650 start_va = 0x7c50000 end_va = 0x7cb2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007c50000" filename = "" Region: id = 651 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 652 start_va = 0x4a00000 end_va = 0x4a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 653 start_va = 0x4a90000 end_va = 0x4a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a90000" filename = "" Region: id = 654 start_va = 0x7cc0000 end_va = 0x7ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cc0000" filename = "" Region: id = 655 start_va = 0x7cd0000 end_va = 0x7cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cd0000" filename = "" Region: id = 673 start_va = 0x7cc0000 end_va = 0x7cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007cc0000" filename = "" Region: id = 674 start_va = 0x7f10000 end_va = 0x800ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f10000" filename = "" Region: id = 697 start_va = 0x8010000 end_va = 0x804ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008010000" filename = "" Region: id = 698 start_va = 0x8050000 end_va = 0x814ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008050000" filename = "" Region: id = 699 start_va = 0x8150000 end_va = 0x818ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008150000" filename = "" Region: id = 700 start_va = 0x8190000 end_va = 0x828ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008190000" filename = "" Region: id = 721 start_va = 0x7a30000 end_va = 0x7a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a30000" filename = "" Region: id = 722 start_va = 0x7a70000 end_va = 0x7b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a70000" filename = "" Thread: id = 1 os_tid = 0x12cc [0127.446] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0130.214] RoInitialize () returned 0x1 [0130.214] RoUninitialize () returned 0x0 [0132.433] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x19ef18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0132.454] IsAppThemed () returned 0x1 [0132.464] CoTaskMemAlloc (cb=0xf0) returned 0x814990 [0132.465] CreateActCtxA (pActCtx=0x19f414) returned 0x8218e4 [0132.644] CoTaskMemFree (pv=0x814990) [0132.660] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc20b [0132.661] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc20a [0132.850] GetSystemMetrics (nIndex=75) returned 1 [0132.857] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0133.632] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6c920000 [0133.725] AdjustWindowRectEx (in: lpRect=0x19f43c, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19f43c) returned 1 [0133.732] GetCurrentProcess () returned 0xffffffff [0133.732] GetCurrentThread () returned 0xfffffffe [0133.732] GetCurrentProcess () returned 0xffffffff [0133.732] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19f354, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19f354*=0x270) returned 1 [0133.735] GetCurrentThreadId () returned 0x12cc [0133.760] GetCurrentActCtx (in: lphActCtx=0x19f2b4 | out: lphActCtx=0x19f2b4*=0x0) returned 1 [0133.762] ActivateActCtx (in: hActCtx=0x8218e4, lpCookie=0x19f2c4 | out: hActCtx=0x8218e4, lpCookie=0x19f2c4) returned 1 [0133.762] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0134.982] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6f0a0000 [0135.004] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75640000 [0135.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x19f17c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWXil\x9bÂà «\"khö\x19", lpUsedDefaultChar=0x0) returned 14 [0135.005] GetProcAddress (hModule=0x75640000, lpProcName="DefWindowProcW") returned 0x744e07e0 [0135.006] GetStockObject (i=5) returned 0x1900015 [0135.031] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0135.095] CoTaskMemAlloc (cb=0x5c) returned 0x81aa60 [0135.095] RegisterClassW (lpWndClass=0x19f16c) returned 0xc150 [0135.096] CoTaskMemFree (pv=0x81aa60) [0135.096] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0135.096] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x70228 [0135.099] SetWindowLongW (hWnd=0x70228, nIndex=-4, dwNewLong=1951270880) returned 78251454 [0135.100] GetWindowLongW (hWnd=0x70228, nIndex=-4) returned 1951270880 [0135.106] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e9cc | out: phkResult=0x19e9cc*=0x290) returned 0x0 [0135.107] RegQueryValueExW (in: hKey=0x290, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19e9ec, lpData=0x0, lpcbData=0x19e9e8*=0x0 | out: lpType=0x19e9ec*=0x0, lpData=0x0, lpcbData=0x19e9e8*=0x0) returned 0x2 [0135.109] RegQueryValueExW (in: hKey=0x290, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19e9ec, lpData=0x0, lpcbData=0x19e9e8*=0x0 | out: lpType=0x19e9ec*=0x0, lpData=0x0, lpcbData=0x19e9e8*=0x0) returned 0x2 [0135.109] RegCloseKey (hKey=0x290) returned 0x0 [0135.112] SetWindowLongW (hWnd=0x70228, nIndex=-4, dwNewLong=78251494) returned 1951270880 [0135.112] GetWindowLongW (hWnd=0x70228, nIndex=-4) returned 78251494 [0135.112] GetWindowLongW (hWnd=0x70228, nIndex=-16) returned 113311744 [0135.113] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc1e6 [0135.115] CallWindowProcW (lpPrevWndFunc=0x744e07e0, hWnd=0x70228, Msg=0x24, wParam=0x0, lParam=0x19ece4) returned 0x0 [0135.115] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc1e7 [0135.116] CallWindowProcW (lpPrevWndFunc=0x744e07e0, hWnd=0x70228, Msg=0x81, wParam=0x0, lParam=0x19ecd8) returned 0x1 [0135.117] CallWindowProcW (lpPrevWndFunc=0x744e07e0, hWnd=0x70228, Msg=0x83, wParam=0x0, lParam=0x19ecc4) returned 0x0 [0135.376] CallWindowProcW (lpPrevWndFunc=0x744e07e0, hWnd=0x70228, Msg=0x1, wParam=0x0, lParam=0x19ecd8) returned 0x0 [0135.377] GetClientRect (in: hWnd=0x70228, lpRect=0x19ea04 | out: lpRect=0x19ea04) returned 1 [0135.377] GetWindowRect (in: hWnd=0x70228, lpRect=0x19ea04 | out: lpRect=0x19ea04) returned 1 [0135.379] GetParent (hWnd=0x70228) returned 0x0 [0135.379] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1ae20001) returned 1 [0135.503] GetSystemDefaultLCID () returned 0x409 [0135.504] GetStockObject (i=17) returned 0x10a0047 [0135.510] GetObjectW (in: h=0x10a0047, c=92, pv=0x19f108 | out: pv=0x19f108) returned 92 [0135.511] GetDC (hWnd=0x0) returned 0x1f010704 [0136.487] GdiplusStartup (in: token=0x5d5ed0, input=0x19e6d0, output=0x19e720 | out: token=0x5d5ed0, output=0x19e720) returned 0x0 [0136.497] CoTaskMemAlloc (cb=0x5c) returned 0x81a4b0 [0136.499] GdipCreateFontFromLogfontW (hdc=0x1f010704, logfont=0x81a4b0, font=0x19f1d0) returned 0x0 [0137.859] CoTaskMemFree (pv=0x81a4b0) [0137.860] CoTaskMemAlloc (cb=0x5c) returned 0x81a580 [0137.860] CoTaskMemFree (pv=0x81a580) [0137.874] CoTaskMemAlloc (cb=0x5c) returned 0x81a858 [0137.875] CoTaskMemFree (pv=0x81a858) [0137.876] GdipGetFontUnit (font=0x4a11f08, unit=0x19f19c) returned 0x0 [0137.877] GdipGetFontSize (font=0x4a11f08, size=0x19f1a0) returned 0x0 [0137.877] GdipGetFontStyle (font=0x4a11f08, style=0x19f198) returned 0x0 [0137.878] GdipGetFamily (font=0x4a11f08, family=0x19f194) returned 0x0 [0137.878] GdipGetFontSize (font=0x4a11f08, size=0x2238a10) returned 0x0 [0137.878] ReleaseDC (hWnd=0x0, hDC=0x1f010704) returned 1 [0137.879] GetDC (hWnd=0x0) returned 0xb01078b [0137.879] GdipCreateFromHDC (hdc=0xb01078b, graphics=0x19f1bc) returned 0x0 [0137.888] GdipGetDpiY (graphics=0x5bbf268, dpi=0x2238b18) returned 0x0 [0137.889] GdipGetFontHeight (font=0x4a11f08, graphics=0x5bbf268, height=0x19f1b4) returned 0x0 [0137.889] GdipGetEmHeight (family=0x5bb5e10, style=0, EmHeight=0x19f1bc) returned 0x0 [0137.889] GdipGetLineSpacing (family=0x5bb5e10, style=0, LineSpacing=0x19f1bc) returned 0x0 [0137.890] GdipDeleteGraphics (graphics=0x5bbf268) returned 0x0 [0137.891] ReleaseDC (hWnd=0x0, hDC=0xb01078b) returned 1 [0137.892] GdipCreateFont (fontFamily=0x5bb5e10, emSize=0x41040000, style=0, unit=0x3, font=0x2238ad8) returned 0x0 [0137.892] GdipGetFontSize (font=0x4a1efc0, size=0x2238adc) returned 0x0 [0137.892] GdipDeleteFont (font=0x4a11f08) returned 0x0 [0137.892] GetDC (hWnd=0x0) returned 0xb01078b [0137.892] GdipCreateFromHDC (hdc=0xb01078b, graphics=0x19f220) returned 0x0 [0137.893] GdipGetFontHeight (font=0x4a1efc0, graphics=0x5bbf268, height=0x19f218) returned 0x0 [0137.893] GdipDeleteGraphics (graphics=0x5bbf268) returned 0x0 [0137.893] ReleaseDC (hWnd=0x0, hDC=0xb01078b) returned 1 [0137.895] GetSystemMetrics (nIndex=5) returned 1 [0137.895] GetSystemMetrics (nIndex=6) returned 1 [0137.895] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.896] AdjustWindowRectEx (in: lpRect=0x19f348, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f348) returned 1 [0137.896] GetDC (hWnd=0x0) returned 0xb01078b [0137.896] GdipCreateFromHDC (hdc=0xb01078b, graphics=0x19f220) returned 0x0 [0137.897] GdipGetFontHeight (font=0x4a1efc0, graphics=0x5bbf268, height=0x19f218) returned 0x0 [0137.897] GdipDeleteGraphics (graphics=0x5bbf268) returned 0x0 [0137.897] ReleaseDC (hWnd=0x0, hDC=0xb01078b) returned 1 [0137.897] GetSystemMetrics (nIndex=5) returned 1 [0137.897] GetSystemMetrics (nIndex=6) returned 1 [0137.897] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.897] AdjustWindowRectEx (in: lpRect=0x19f348, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f348) returned 1 [0137.900] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.901] AdjustWindowRectEx (in: lpRect=0x19f34c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f34c) returned 1 [0137.901] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.901] AdjustWindowRectEx (in: lpRect=0x19f34c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f34c) returned 1 [0137.902] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.902] AdjustWindowRectEx (in: lpRect=0x19f348, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f348) returned 1 [0137.902] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.902] AdjustWindowRectEx (in: lpRect=0x19f34c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f34c) returned 1 [0137.903] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.903] AdjustWindowRectEx (in: lpRect=0x19f34c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f34c) returned 1 [0137.903] GetSystemMetrics (nIndex=5) returned 1 [0137.903] GetSystemMetrics (nIndex=6) returned 1 [0137.904] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.904] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f2ac) returned 1 [0137.904] GetSystemMetrics (nIndex=5) returned 1 [0137.904] GetSystemMetrics (nIndex=6) returned 1 [0137.905] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.905] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f2ac) returned 1 [0137.907] GetSystemMetrics (nIndex=5) returned 1 [0137.907] GetSystemMetrics (nIndex=6) returned 1 [0137.907] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.907] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f2ac) returned 1 [0137.907] GetSystemMetrics (nIndex=5) returned 1 [0137.908] GetSystemMetrics (nIndex=6) returned 1 [0137.908] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.908] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f2ac) returned 1 [0137.910] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.911] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1 [0137.956] GetProcessWindowStation () returned 0xf0 [0137.959] GetUserObjectInformationA (in: hObj=0xf0, nIndex=1, pvInfo=0x2239d74, nLength=0xc, lpnLengthNeeded=0x19f188 | out: pvInfo=0x2239d74, lpnLengthNeeded=0x19f188) returned 1 [0137.968] SetConsoleCtrlHandler (HandlerRoutine=0x4aa060e, Add=1) returned 1 [0137.968] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0137.969] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0137.971] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x2239dd8 | out: lpWndClass=0x2239dd8) returned 0 [0137.973] CoTaskMemAlloc (cb=0x58) returned 0x8179f8 [0137.973] RegisterClassW (lpWndClass=0x19f0d8) returned 0xc20c [0137.973] CoTaskMemFree (pv=0x8179f8) [0137.974] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x502ec [0137.975] NtdllDefWindowProc_W (hWnd=0x502ec, Msg=0x81, wParam=0x0, lParam=0x19ec18) returned 0x1 [0137.979] NtdllDefWindowProc_W (hWnd=0x502ec, Msg=0x83, wParam=0x0, lParam=0x19ec04) returned 0x0 [0137.979] NtdllDefWindowProc_W (hWnd=0x502ec, Msg=0x1, wParam=0x0, lParam=0x19ec18) returned 0x0 [0137.980] NtdllDefWindowProc_W (hWnd=0x502ec, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0137.980] NtdllDefWindowProc_W (hWnd=0x502ec, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0137.986] GetSysColor (nIndex=10) returned 0xb4b4b4 [0137.986] GetSysColor (nIndex=2) returned 0xd1b499 [0137.987] GetSysColor (nIndex=9) returned 0x0 [0137.987] GetSysColor (nIndex=12) returned 0xababab [0137.987] GetSysColor (nIndex=15) returned 0xf0f0f0 [0137.987] GetSysColor (nIndex=20) returned 0xffffff [0137.987] GetSysColor (nIndex=16) returned 0xa0a0a0 [0137.987] GetSysColor (nIndex=15) returned 0xf0f0f0 [0137.987] GetSysColor (nIndex=16) returned 0xa0a0a0 [0137.987] GetSysColor (nIndex=21) returned 0x696969 [0137.987] GetSysColor (nIndex=22) returned 0xe3e3e3 [0137.987] GetSysColor (nIndex=20) returned 0xffffff [0137.987] GetSysColor (nIndex=18) returned 0x0 [0137.988] GetSysColor (nIndex=1) returned 0x0 [0137.988] GetSysColor (nIndex=27) returned 0xead1b9 [0137.988] GetSysColor (nIndex=28) returned 0xf2e4d7 [0137.988] GetSysColor (nIndex=17) returned 0x6d6d6d [0137.988] GetSysColor (nIndex=13) returned 0xff9933 [0137.988] GetSysColor (nIndex=14) returned 0xffffff [0137.988] GetSysColor (nIndex=26) returned 0xcc6600 [0137.988] GetSysColor (nIndex=11) returned 0xfcf7f4 [0137.988] GetSysColor (nIndex=3) returned 0xdbcdbf [0137.989] GetSysColor (nIndex=19) returned 0x0 [0137.989] GetSysColor (nIndex=24) returned 0xe1ffff [0137.989] GetSysColor (nIndex=23) returned 0x0 [0137.989] GetSysColor (nIndex=4) returned 0xf0f0f0 [0137.989] GetSysColor (nIndex=30) returned 0xf0f0f0 [0137.989] GetSysColor (nIndex=29) returned 0xff9933 [0137.989] GetSysColor (nIndex=7) returned 0x0 [0137.989] GetSysColor (nIndex=0) returned 0xc8c8c8 [0137.989] GetSysColor (nIndex=5) returned 0xffffff [0137.989] GetSysColor (nIndex=6) returned 0x646464 [0137.989] GetSysColor (nIndex=8) returned 0x0 [0137.989] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.990] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1 [0137.990] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.991] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1 [0137.991] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.991] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1 [0137.991] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0137.991] AdjustWindowRectEx (in: lpRect=0x19f2d8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2d8) returned 1 [0137.999] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x19f328) returned 0x0 [0138.000] GdipCreateFont (fontFamily=0x5bb5e10, emSize=0x41400000, style=0, unit=0x3, font=0x223a3ac) returned 0x0 [0138.000] GdipGetFontSize (font=0x4a11f08, size=0x223a3b0) returned 0x0 [0138.002] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.002] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1 [0138.002] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.002] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1 [0138.003] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.003] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1 [0138.003] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.003] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1 [0138.005] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.005] AdjustWindowRectEx (in: lpRect=0x19f30c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f30c) returned 1 [0138.005] GetSystemMetrics (nIndex=59) returned 1456 [0138.005] GetSystemMetrics (nIndex=60) returned 916 [0138.005] GetSystemMetrics (nIndex=34) returned 136 [0138.005] GetSystemMetrics (nIndex=35) returned 39 [0138.009] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.009] AdjustWindowRectEx (in: lpRect=0x19f20c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f20c) returned 1 [0138.009] GetCurrentThreadId () returned 0x12cc [0138.009] GetCurrentThreadId () returned 0x12cc [0138.011] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.011] AdjustWindowRectEx (in: lpRect=0x19f108, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f108) returned 1 [0138.020] GdipGetFamilyName (in: family=0x5bb5e10, name=0x19eff8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0138.021] CreateCompatibleDC (hdc=0x0) returned 0x40010682 [0138.023] GetCurrentObject (hdc=0x40010682, type=0x1) returned 0x1b00017 [0138.023] GetCurrentObject (hdc=0x40010682, type=0x2) returned 0x1900010 [0138.023] GetCurrentObject (hdc=0x40010682, type=0x7) returned 0x185000f [0138.023] GetCurrentObject (hdc=0x40010682, type=0x6) returned 0x18a0048 [0138.026] SaveDC (hdc=0x40010682) returned 1 [0138.026] GetDeviceCaps (hdc=0x40010682, index=90) returned 96 [0138.028] CoTaskMemAlloc (cb=0x5c) returned 0x81a4b0 [0138.028] CreateFontIndirectW (lplf=0x81a4b0) returned 0x320a07b7 [0138.028] CoTaskMemFree (pv=0x81a4b0) [0138.029] GetObjectW (in: h=0x320a07b7, c=92, pv=0x19efd0 | out: pv=0x19efd0) returned 92 [0138.029] GetCurrentObject (hdc=0x40010682, type=0x6) returned 0x18a0048 [0138.029] GetObjectW (in: h=0x18a0048, c=92, pv=0x19ef28 | out: pv=0x19ef28) returned 92 [0138.030] SelectObject (hdc=0x40010682, h=0x320a07b7) returned 0x18a0048 [0138.030] GetMapMode (hdc=0x40010682) returned 1 [0138.030] GetTextMetricsW (in: hdc=0x40010682, lptm=0x19efdc | out: lptm=0x19efdc) returned 1 [0138.032] DrawTextExW (in: hdc=0x40010682, lpchText="Author: Ali Umar ", cchText=17, lprc=0x19f0f0, format=0x2400, lpdtp=0x223abe0 | out: lpchText="Author: Ali Umar ", lprc=0x19f0f0) returned 13 [0138.117] GetCurrentThreadId () returned 0x12cc [0138.117] GetCurrentThreadId () returned 0x12cc [0138.117] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.117] AdjustWindowRectEx (in: lpRect=0x19f108, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f108) returned 1 [0138.117] GdipGetFamilyName (in: family=0x5bb5e10, name=0x19eff8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0138.117] GetDeviceCaps (hdc=0x40010682, index=90) returned 96 [0138.117] CoTaskMemAlloc (cb=0x5c) returned 0x81a580 [0138.117] CreateFontIndirectW (lplf=0x81a580) returned 0x300a07b4 [0138.118] CoTaskMemFree (pv=0x81a580) [0138.118] GetObjectW (in: h=0x300a07b4, c=92, pv=0x19efd0 | out: pv=0x19efd0) returned 92 [0138.121] SelectObject (hdc=0x40010682, h=0x300a07b4) returned 0x320a07b7 [0138.121] GetMapMode (hdc=0x40010682) returned 1 [0138.121] GetTextMetricsW (in: hdc=0x40010682, lptm=0x19efdc | out: lptm=0x19efdc) returned 1 [0138.121] DrawTextExW (in: hdc=0x40010682, lpchText="Welcome, to the simple client/server application.", cchText=49, lprc=0x19f0f0, format=0x2400, lpdtp=0x223ae7c | out: lpchText="Welcome, to the simple client/server application.", lprc=0x19f0f0) returned 20 [0138.165] GetCurrentThreadId () returned 0x12cc [0138.165] GetCurrentThreadId () returned 0x12cc [0138.165] GetCurrentThreadId () returned 0x12cc [0138.165] GetCurrentThreadId () returned 0x12cc [0138.165] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.166] AdjustWindowRectEx (in: lpRect=0x19f108, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f108) returned 1 [0138.166] SelectObject (hdc=0x40010682, h=0x320a07b7) returned 0x300a07b4 [0138.166] DrawTextExW (in: hdc=0x40010682, lpchText="IP Address/Host", cchText=15, lprc=0x19f0f0, format=0x2400, lpdtp=0x223afc0 | out: lpchText="IP Address/Host", lprc=0x19f0f0) returned 13 [0138.166] GetCurrentThreadId () returned 0x12cc [0138.166] GetCurrentThreadId () returned 0x12cc [0138.166] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.166] AdjustWindowRectEx (in: lpRect=0x19f108, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f108) returned 1 [0138.167] DrawTextExW (in: hdc=0x40010682, lpchText="Account No", cchText=10, lprc=0x19f0f0, format=0x2400, lpdtp=0x223b0d0 | out: lpchText="Account No", lprc=0x19f0f0) returned 13 [0138.167] GetCurrentThreadId () returned 0x12cc [0138.167] GetCurrentThreadId () returned 0x12cc [0138.167] GetCurrentThreadId () returned 0x12cc [0138.167] GetCurrentThreadId () returned 0x12cc [0138.170] CreateCompatibleDC (hdc=0x0) returned 0x5c01080c [0138.171] GetDC (hWnd=0x0) returned 0x10107f0 [0138.171] GdipCreateFromHDC (hdc=0x10107f0, graphics=0x19f148) returned 0x0 [0138.172] CoTaskMemAlloc (cb=0x5c) returned 0x81a858 [0138.172] GdipGetLogFontW (font=0x4a1efc0, graphics=0x5bbf268, logfontW=0x81a858) returned 0x0 [0138.176] CoTaskMemFree (pv=0x81a858) [0138.176] CoTaskMemAlloc (cb=0x5c) returned 0x81a9f8 [0138.176] CoTaskMemFree (pv=0x81a9f8) [0138.176] CoTaskMemAlloc (cb=0x5c) returned 0x81a4b0 [0138.176] CoTaskMemFree (pv=0x81a4b0) [0138.176] GdipDeleteGraphics (graphics=0x5bbf268) returned 0x0 [0138.176] ReleaseDC (hWnd=0x0, hDC=0x10107f0) returned 1 [0138.177] CoTaskMemAlloc (cb=0x5c) returned 0x81a9f8 [0138.177] CreateFontIndirectW (lplf=0x81a9f8) returned 0x430a0951 [0138.177] CoTaskMemFree (pv=0x81a9f8) [0138.177] SelectObject (hdc=0x5c01080c, h=0x430a0951) returned 0x18a0048 [0138.177] GetTextMetricsW (in: hdc=0x5c01080c, lptm=0x19f254 | out: lptm=0x19f254) returned 1 [0138.178] GetTextExtentPoint32W (in: hdc=0x5c01080c, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x223b8a4 | out: psizl=0x223b8a4) returned 1 [0138.178] SelectObject (hdc=0x5c01080c, h=0x18a0048) returned 0x430a0951 [0138.179] DeleteDC (hdc=0x5c01080c) returned 1 [0138.181] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.181] AdjustWindowRectEx (in: lpRect=0x19efc0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19efc0) returned 1 [0138.184] GetCursorPos (in: lpPoint=0x223b8c4 | out: lpPoint=0x223b8c4*(x=1116, y=696)) returned 1 [0138.186] GetSystemMetrics (nIndex=80) returned 1 [0138.193] MonitorFromPoint (pt=0x45c, dwFlags=0x2b8) returned 0x10001 [0138.194] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ee9c | out: lpmi=0x19ee9c) returned 1 [0138.195] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x5e01080c [0138.195] GetDeviceCaps (hdc=0x5e01080c, index=12) returned 32 [0138.195] GetDeviceCaps (hdc=0x5e01080c, index=14) returned 1 [0138.195] DeleteDC (hdc=0x5e01080c) returned 1 [0138.196] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19eef0 | out: lpmi=0x19eef0) returned 1 [0138.196] AdjustWindowRectEx (in: lpRect=0x19f1e0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f1e0) returned 1 [0138.197] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.197] AdjustWindowRectEx (in: lpRect=0x19ef38, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ef38) returned 1 [0138.197] GetCursorPos (in: lpPoint=0x223bbf8 | out: lpPoint=0x223bbf8*(x=1116, y=696)) returned 1 [0138.197] MonitorFromPoint (pt=0x45d, dwFlags=0x2b5) returned 0x10001 [0138.197] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ee14 | out: lpmi=0x19ee14) returned 1 [0138.198] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x5f01080c [0138.198] GetDeviceCaps (hdc=0x5f01080c, index=12) returned 32 [0138.198] GetDeviceCaps (hdc=0x5f01080c, index=14) returned 1 [0138.198] DeleteDC (hdc=0x5f01080c) returned 1 [0138.198] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ee68 | out: lpmi=0x19ee68) returned 1 [0138.198] AdjustWindowRectEx (in: lpRect=0x19f018, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f018) returned 1 [0138.198] GetSystemMetrics (nIndex=34) returned 136 [0138.198] GetSystemMetrics (nIndex=35) returned 39 [0138.199] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.199] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1d8) returned 1 [0138.199] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.199] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f03c) returned 1 [0138.199] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.253] AdjustWindowRectEx (in: lpRect=0x19ee98, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee98) returned 1 [0138.254] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.254] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1d8) returned 1 [0138.254] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.254] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f03c) returned 1 [0138.254] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.254] AdjustWindowRectEx (in: lpRect=0x19ee98, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee98) returned 1 [0138.255] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.255] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1d8) returned 1 [0138.255] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.255] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f03c) returned 1 [0138.255] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.255] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1d8) returned 1 [0138.255] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.255] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f03c) returned 1 [0138.256] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.256] AdjustWindowRectEx (in: lpRect=0x19ee98, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee98) returned 1 [0138.256] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.256] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1d8) returned 1 [0138.256] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.256] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f03c) returned 1 [0138.256] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.256] AdjustWindowRectEx (in: lpRect=0x19ee98, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee98) returned 1 [0138.256] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.256] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f1d8) returned 1 [0138.257] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.259] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f03c) returned 1 [0138.259] GetSystemMetrics (nIndex=5) returned 1 [0138.259] GetSystemMetrics (nIndex=6) returned 1 [0138.259] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.259] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f1d8) returned 1 [0138.259] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6c920000 [0138.259] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f03c) returned 1 [0138.259] GetSystemMetrics (nIndex=5) returned 1 [0138.259] GetSystemMetrics (nIndex=6) returned 1 [0138.295] EtwEventRegister (in: ProviderId=0x223c3f8, EnableCallback=0x4aa065e, CallbackContext=0x0, RegHandle=0x223c3d4 | out: RegHandle=0x223c3d4) returned 0x0 [0138.299] EtwEventSetInformation (RegHandle=0x808cc0, InformationClass=0x2c, EventInformation=0x2, InformationLength=0x223c368) returned 0x0 [0138.317] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe.config", nBufferLength=0x105, lpBuffer=0x19ebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe.config", lpFilePart=0x0) returned 0x69 [0138.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f070) returned 1 [0138.318] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19f0ec | out: lpFileInformation=0x19f0ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0138.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f06c) returned 1 [0138.872] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11400, lpName=0x0) returned 0x2d0 [0138.872] memcpy (in: _Dst=0x4890000, _Src=0x223eae4, _Size=0x11400 | out: _Dst=0x4890000) returned 0x4890000 [0138.873] CloseHandle (hObject=0x2d0) returned 1 [0188.583] GdipLoadImageFromStream (stream=0x590030, image=0x19e530) returned 0x0 [0188.932] GdipImageForceValidation (image=0x5bbf268) returned 0x0 [0188.962] GdipGetImageType (image=0x5bbf268, type=0x19e52c) returned 0x0 [0188.962] GdipGetImageRawFormat (image=0x5bbf268, format=0x19e4ac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0188.997] GdipGetImageWidth (image=0x5bbf268, width=0x19ea90) returned 0x0 [0188.998] GdipGetImageHeight (image=0x5bbf268, height=0x19ea90) returned 0x0 [0189.128] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.128] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.129] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=0, color=0x19ea80) returned 0x0 [0189.290] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.290] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.290] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=1, color=0x19ea80) returned 0x0 [0189.290] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.290] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.290] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=2, color=0x19ea80) returned 0x0 [0189.291] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.291] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.291] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=3, color=0x19ea80) returned 0x0 [0189.291] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.291] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.291] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=4, color=0x19ea80) returned 0x0 [0189.291] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.291] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.291] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=5, color=0x19ea80) returned 0x0 [0189.291] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.291] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.291] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=6, color=0x19ea80) returned 0x0 [0189.292] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.292] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.292] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=7, color=0x19ea80) returned 0x0 [0189.292] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.292] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.292] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=8, color=0x19ea80) returned 0x0 [0189.292] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.292] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.292] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=9, color=0x19ea80) returned 0x0 [0189.292] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.292] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.292] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=10, color=0x19ea80) returned 0x0 [0189.292] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.292] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.293] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=11, color=0x19ea80) returned 0x0 [0189.293] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.293] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.293] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=12, color=0x19ea80) returned 0x0 [0189.293] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.293] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.293] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=13, color=0x19ea80) returned 0x0 [0189.293] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.293] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.293] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=14, color=0x19ea80) returned 0x0 [0189.293] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.293] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.293] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=15, color=0x19ea80) returned 0x0 [0189.293] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.293] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.293] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=16, color=0x19ea80) returned 0x0 [0189.293] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.294] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.294] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=17, color=0x19ea80) returned 0x0 [0189.294] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.294] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.294] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=18, color=0x19ea80) returned 0x0 [0189.294] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.294] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.294] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=19, color=0x19ea80) returned 0x0 [0189.294] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.294] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.294] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=20, color=0x19ea80) returned 0x0 [0189.294] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.294] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.294] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=21, color=0x19ea80) returned 0x0 [0189.294] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.294] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.294] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=22, color=0x19ea80) returned 0x0 [0189.295] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.295] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.295] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=23, color=0x19ea80) returned 0x0 [0189.295] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.295] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.295] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=24, color=0x19ea80) returned 0x0 [0189.295] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.295] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.295] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=25, color=0x19ea80) returned 0x0 [0189.295] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.295] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.295] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=26, color=0x19ea80) returned 0x0 [0189.295] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.295] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.295] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=27, color=0x19ea80) returned 0x0 [0189.295] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.295] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.295] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=28, color=0x19ea80) returned 0x0 [0189.296] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.296] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.296] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=29, color=0x19ea80) returned 0x0 [0189.296] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.296] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.296] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=30, color=0x19ea80) returned 0x0 [0189.296] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.296] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.296] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=31, color=0x19ea80) returned 0x0 [0189.296] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.296] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.296] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=32, color=0x19ea80) returned 0x0 [0189.296] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.296] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.297] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=33, color=0x19ea80) returned 0x0 [0189.297] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.297] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.297] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=34, color=0x19ea80) returned 0x0 [0189.297] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.297] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.297] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=35, color=0x19ea80) returned 0x0 [0189.297] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.297] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.297] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=36, color=0x19ea80) returned 0x0 [0189.297] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.297] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.297] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=37, color=0x19ea80) returned 0x0 [0189.297] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.298] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.298] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=38, color=0x19ea80) returned 0x0 [0189.298] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.298] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.298] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=39, color=0x19ea80) returned 0x0 [0189.298] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.298] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.298] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=40, color=0x19ea80) returned 0x0 [0189.298] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.298] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.298] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=41, color=0x19ea80) returned 0x0 [0189.298] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.298] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.298] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=42, color=0x19ea80) returned 0x0 [0189.298] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.299] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.299] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=43, color=0x19ea80) returned 0x0 [0189.299] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.299] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.299] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=44, color=0x19ea80) returned 0x0 [0189.299] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.299] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.299] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=45, color=0x19ea80) returned 0x0 [0189.299] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.299] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.299] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=46, color=0x19ea80) returned 0x0 [0189.300] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.300] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.300] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=47, color=0x19ea80) returned 0x0 [0189.300] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.300] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.300] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=48, color=0x19ea80) returned 0x0 [0189.300] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.300] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.300] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=49, color=0x19ea80) returned 0x0 [0189.300] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.300] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.300] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=50, color=0x19ea80) returned 0x0 [0189.300] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.300] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.301] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=51, color=0x19ea80) returned 0x0 [0189.301] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.301] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.301] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=52, color=0x19ea80) returned 0x0 [0189.301] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.301] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.301] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=53, color=0x19ea80) returned 0x0 [0189.301] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.301] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.301] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=54, color=0x19ea80) returned 0x0 [0189.301] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.301] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.302] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=55, color=0x19ea80) returned 0x0 [0189.302] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.302] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.302] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=56, color=0x19ea80) returned 0x0 [0189.302] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.302] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.302] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=57, color=0x19ea80) returned 0x0 [0189.302] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.302] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.302] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=58, color=0x19ea80) returned 0x0 [0189.302] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.302] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.302] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=59, color=0x19ea80) returned 0x0 [0189.303] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.303] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.303] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=60, color=0x19ea80) returned 0x0 [0189.303] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.303] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.303] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=61, color=0x19ea80) returned 0x0 [0189.303] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.303] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.303] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=62, color=0x19ea80) returned 0x0 [0189.303] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.303] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.303] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=63, color=0x19ea80) returned 0x0 [0189.303] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.303] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.303] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=64, color=0x19ea80) returned 0x0 [0189.303] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.304] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.304] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=65, color=0x19ea80) returned 0x0 [0189.304] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.304] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.304] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=66, color=0x19ea80) returned 0x0 [0189.304] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.304] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.304] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=67, color=0x19ea80) returned 0x0 [0189.304] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.304] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.304] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=68, color=0x19ea80) returned 0x0 [0189.304] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.304] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.304] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=69, color=0x19ea80) returned 0x0 [0189.304] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.305] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.305] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=70, color=0x19ea80) returned 0x0 [0189.305] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.305] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.305] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=71, color=0x19ea80) returned 0x0 [0189.305] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.305] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.305] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=72, color=0x19ea80) returned 0x0 [0189.305] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.305] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.305] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=73, color=0x19ea80) returned 0x0 [0189.305] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.305] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.305] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=74, color=0x19ea80) returned 0x0 [0189.306] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.306] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.306] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=75, color=0x19ea80) returned 0x0 [0189.306] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.306] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.306] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=76, color=0x19ea80) returned 0x0 [0189.306] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.306] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.306] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=77, color=0x19ea80) returned 0x0 [0189.306] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.306] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.306] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=78, color=0x19ea80) returned 0x0 [0189.306] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.306] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.306] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=79, color=0x19ea80) returned 0x0 [0189.307] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.307] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.307] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=80, color=0x19ea80) returned 0x0 [0189.307] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.307] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.307] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=81, color=0x19ea80) returned 0x0 [0189.307] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.307] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.307] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=82, color=0x19ea80) returned 0x0 [0189.307] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.307] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.307] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=83, color=0x19ea80) returned 0x0 [0189.307] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.307] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.307] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=84, color=0x19ea80) returned 0x0 [0189.308] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.308] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.308] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=85, color=0x19ea80) returned 0x0 [0189.308] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.308] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.308] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=86, color=0x19ea80) returned 0x0 [0189.308] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.308] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.308] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=87, color=0x19ea80) returned 0x0 [0189.308] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.308] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.308] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=88, color=0x19ea80) returned 0x0 [0189.308] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.308] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.308] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=89, color=0x19ea80) returned 0x0 [0189.308] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.308] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.308] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=90, color=0x19ea80) returned 0x0 [0189.309] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.309] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.309] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=91, color=0x19ea80) returned 0x0 [0189.309] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.309] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.321] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=92, color=0x19ea80) returned 0x0 [0189.321] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.321] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.321] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=93, color=0x19ea80) returned 0x0 [0189.321] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.321] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.321] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=94, color=0x19ea80) returned 0x0 [0189.321] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.321] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.321] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=95, color=0x19ea80) returned 0x0 [0189.321] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.321] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.321] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=96, color=0x19ea80) returned 0x0 [0189.321] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.322] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.322] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=97, color=0x19ea80) returned 0x0 [0189.322] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.322] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.322] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=98, color=0x19ea80) returned 0x0 [0189.322] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.322] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.322] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=99, color=0x19ea80) returned 0x0 [0189.322] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.322] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.322] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=100, color=0x19ea80) returned 0x0 [0189.322] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.322] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.322] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=101, color=0x19ea80) returned 0x0 [0189.323] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.323] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.323] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=102, color=0x19ea80) returned 0x0 [0189.323] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.323] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.323] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=103, color=0x19ea80) returned 0x0 [0189.323] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.323] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.323] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=104, color=0x19ea80) returned 0x0 [0189.323] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.323] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.323] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=105, color=0x19ea80) returned 0x0 [0189.323] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.323] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.323] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=106, color=0x19ea80) returned 0x0 [0189.323] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.323] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.323] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=107, color=0x19ea80) returned 0x0 [0189.324] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.324] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.324] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=108, color=0x19ea80) returned 0x0 [0189.324] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.324] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.324] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=109, color=0x19ea80) returned 0x0 [0189.324] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.324] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.324] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=110, color=0x19ea80) returned 0x0 [0189.324] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.324] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.324] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=111, color=0x19ea80) returned 0x0 [0189.324] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.324] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.324] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=112, color=0x19ea80) returned 0x0 [0189.324] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.324] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.324] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=113, color=0x19ea80) returned 0x0 [0189.325] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.325] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.325] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=114, color=0x19ea80) returned 0x0 [0189.325] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.325] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.325] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=115, color=0x19ea80) returned 0x0 [0189.325] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.325] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.325] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=116, color=0x19ea80) returned 0x0 [0189.325] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.325] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.325] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=117, color=0x19ea80) returned 0x0 [0189.325] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.325] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.325] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=118, color=0x19ea80) returned 0x0 [0189.326] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.326] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.326] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=119, color=0x19ea80) returned 0x0 [0189.326] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.326] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.326] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=120, color=0x19ea80) returned 0x0 [0189.326] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.326] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.326] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=121, color=0x19ea80) returned 0x0 [0189.326] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.326] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.326] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=122, color=0x19ea80) returned 0x0 [0189.326] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.326] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.326] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=123, color=0x19ea80) returned 0x0 [0189.326] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.326] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.326] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=124, color=0x19ea80) returned 0x0 [0189.327] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.327] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.327] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=125, color=0x19ea80) returned 0x0 [0189.327] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.327] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.327] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=126, color=0x19ea80) returned 0x0 [0189.327] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.327] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.327] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=127, color=0x19ea80) returned 0x0 [0189.327] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.327] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.327] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=128, color=0x19ea80) returned 0x0 [0189.327] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.327] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.327] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=129, color=0x19ea80) returned 0x0 [0189.327] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.328] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.328] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=130, color=0x19ea80) returned 0x0 [0189.328] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.328] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.328] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=131, color=0x19ea80) returned 0x0 [0189.328] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.328] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.328] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=132, color=0x19ea80) returned 0x0 [0189.328] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.328] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.328] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=133, color=0x19ea80) returned 0x0 [0189.328] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.328] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.328] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=134, color=0x19ea80) returned 0x0 [0189.328] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.328] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.328] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=135, color=0x19ea80) returned 0x0 [0189.329] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.329] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.329] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=136, color=0x19ea80) returned 0x0 [0189.329] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.329] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.329] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=137, color=0x19ea80) returned 0x0 [0189.329] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.329] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.329] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=138, color=0x19ea80) returned 0x0 [0189.329] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.329] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.329] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=139, color=0x19ea80) returned 0x0 [0189.329] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.329] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.329] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=140, color=0x19ea80) returned 0x0 [0189.329] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.329] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.329] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=141, color=0x19ea80) returned 0x0 [0189.330] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.330] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.330] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=142, color=0x19ea80) returned 0x0 [0189.330] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.330] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.330] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=143, color=0x19ea80) returned 0x0 [0189.330] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.330] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.330] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=144, color=0x19ea80) returned 0x0 [0189.330] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.330] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.330] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=145, color=0x19ea80) returned 0x0 [0189.331] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.331] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.331] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=146, color=0x19ea80) returned 0x0 [0189.331] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.331] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.331] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=147, color=0x19ea80) returned 0x0 [0189.331] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.331] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.331] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=148, color=0x19ea80) returned 0x0 [0189.331] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.331] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.331] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=149, color=0x19ea80) returned 0x0 [0189.331] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.331] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.331] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=150, color=0x19ea80) returned 0x0 [0189.331] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.331] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.331] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=151, color=0x19ea80) returned 0x0 [0189.332] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.332] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.332] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=152, color=0x19ea80) returned 0x0 [0189.332] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.332] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.332] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=153, color=0x19ea80) returned 0x0 [0189.332] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.332] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.332] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=154, color=0x19ea80) returned 0x0 [0189.332] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.332] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.332] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=155, color=0x19ea80) returned 0x0 [0189.332] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.332] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.332] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=156, color=0x19ea80) returned 0x0 [0189.333] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.333] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.333] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=157, color=0x19ea80) returned 0x0 [0189.333] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.333] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.333] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=158, color=0x19ea80) returned 0x0 [0189.333] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.333] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.333] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=159, color=0x19ea80) returned 0x0 [0189.333] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.333] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.333] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=160, color=0x19ea80) returned 0x0 [0189.333] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.333] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.333] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=161, color=0x19ea80) returned 0x0 [0189.333] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.333] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.333] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=162, color=0x19ea80) returned 0x0 [0189.334] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.334] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.334] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=163, color=0x19ea80) returned 0x0 [0189.334] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.334] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.334] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=164, color=0x19ea80) returned 0x0 [0189.334] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.334] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.334] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=165, color=0x19ea80) returned 0x0 [0189.334] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.334] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.334] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=166, color=0x19ea80) returned 0x0 [0189.334] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.334] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.334] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=167, color=0x19ea80) returned 0x0 [0189.334] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.334] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.334] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=168, color=0x19ea80) returned 0x0 [0189.335] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.335] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.335] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=169, color=0x19ea80) returned 0x0 [0189.335] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.335] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.335] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=170, color=0x19ea80) returned 0x0 [0189.335] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.335] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.335] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=171, color=0x19ea80) returned 0x0 [0189.335] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.335] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.335] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=172, color=0x19ea80) returned 0x0 [0189.335] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.335] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.335] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=173, color=0x19ea80) returned 0x0 [0189.335] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.335] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.335] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=174, color=0x19ea80) returned 0x0 [0189.336] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.336] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.336] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=175, color=0x19ea80) returned 0x0 [0189.336] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.336] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.336] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=176, color=0x19ea80) returned 0x0 [0189.336] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.336] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.336] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=177, color=0x19ea80) returned 0x0 [0189.336] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.336] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.336] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=178, color=0x19ea80) returned 0x0 [0189.336] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.336] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.336] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=179, color=0x19ea80) returned 0x0 [0189.336] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.336] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.336] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=180, color=0x19ea80) returned 0x0 [0189.337] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.337] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.337] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=181, color=0x19ea80) returned 0x0 [0189.337] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.337] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.337] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=182, color=0x19ea80) returned 0x0 [0189.337] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.337] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.337] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=183, color=0x19ea80) returned 0x0 [0189.337] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.337] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.337] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=184, color=0x19ea80) returned 0x0 [0189.337] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.337] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.337] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=185, color=0x19ea80) returned 0x0 [0189.337] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.337] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.338] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=186, color=0x19ea80) returned 0x0 [0189.338] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.338] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.338] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=187, color=0x19ea80) returned 0x0 [0189.338] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.338] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.338] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=188, color=0x19ea80) returned 0x0 [0189.338] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.338] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.338] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=189, color=0x19ea80) returned 0x0 [0189.338] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.338] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.338] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=190, color=0x19ea80) returned 0x0 [0189.338] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.338] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.338] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=191, color=0x19ea80) returned 0x0 [0189.339] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.339] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.339] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=192, color=0x19ea80) returned 0x0 [0189.339] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.339] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.339] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=193, color=0x19ea80) returned 0x0 [0189.339] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.339] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.339] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=194, color=0x19ea80) returned 0x0 [0189.339] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.339] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.339] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=195, color=0x19ea80) returned 0x0 [0189.339] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.339] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.339] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=196, color=0x19ea80) returned 0x0 [0189.339] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.339] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.340] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=197, color=0x19ea80) returned 0x0 [0189.340] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.340] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.340] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=198, color=0x19ea80) returned 0x0 [0189.340] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.340] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.340] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=199, color=0x19ea80) returned 0x0 [0189.340] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.340] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.340] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=200, color=0x19ea80) returned 0x0 [0189.340] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.341] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.341] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=201, color=0x19ea80) returned 0x0 [0189.341] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.341] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.341] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=202, color=0x19ea80) returned 0x0 [0189.341] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.341] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.341] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=203, color=0x19ea80) returned 0x0 [0189.341] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.341] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.341] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=204, color=0x19ea80) returned 0x0 [0189.341] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.341] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.341] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=205, color=0x19ea80) returned 0x0 [0189.341] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.341] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.341] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=206, color=0x19ea80) returned 0x0 [0189.341] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.341] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.341] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=207, color=0x19ea80) returned 0x0 [0189.342] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.342] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.342] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=208, color=0x19ea80) returned 0x0 [0189.342] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.342] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.342] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=209, color=0x19ea80) returned 0x0 [0189.342] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.342] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.342] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=210, color=0x19ea80) returned 0x0 [0189.342] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.342] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.342] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=211, color=0x19ea80) returned 0x0 [0189.342] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.342] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.342] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=212, color=0x19ea80) returned 0x0 [0189.342] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.342] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.342] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=213, color=0x19ea80) returned 0x0 [0189.342] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.343] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.343] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=214, color=0x19ea80) returned 0x0 [0189.343] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.343] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.343] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=215, color=0x19ea80) returned 0x0 [0189.344] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.344] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.344] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=216, color=0x19ea80) returned 0x0 [0189.344] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.344] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.344] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=217, color=0x19ea80) returned 0x0 [0189.344] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.344] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.344] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=218, color=0x19ea80) returned 0x0 [0189.344] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.344] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.344] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=219, color=0x19ea80) returned 0x0 [0189.345] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.345] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.345] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=220, color=0x19ea80) returned 0x0 [0189.345] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.345] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.345] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=221, color=0x19ea80) returned 0x0 [0189.345] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.345] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.345] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=222, color=0x19ea80) returned 0x0 [0189.345] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.345] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.345] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=223, color=0x19ea80) returned 0x0 [0189.345] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.345] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.346] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=224, color=0x19ea80) returned 0x0 [0189.346] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.346] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.346] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=225, color=0x19ea80) returned 0x0 [0189.346] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.346] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.346] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=226, color=0x19ea80) returned 0x0 [0189.346] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.346] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.346] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=227, color=0x19ea80) returned 0x0 [0189.346] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.346] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.346] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=228, color=0x19ea80) returned 0x0 [0189.347] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.347] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.347] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=229, color=0x19ea80) returned 0x0 [0189.347] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.347] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.347] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=230, color=0x19ea80) returned 0x0 [0189.347] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.347] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.347] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=231, color=0x19ea80) returned 0x0 [0189.347] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.347] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.347] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=232, color=0x19ea80) returned 0x0 [0189.347] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.347] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.347] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=233, color=0x19ea80) returned 0x0 [0189.347] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.347] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.347] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=234, color=0x19ea80) returned 0x0 [0189.348] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.348] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.348] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=235, color=0x19ea80) returned 0x0 [0189.348] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.348] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.348] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=236, color=0x19ea80) returned 0x0 [0189.348] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.348] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.348] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=237, color=0x19ea80) returned 0x0 [0189.348] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.348] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.348] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=238, color=0x19ea80) returned 0x0 [0189.348] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.348] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.348] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=239, color=0x19ea80) returned 0x0 [0189.348] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.348] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.349] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=240, color=0x19ea80) returned 0x0 [0189.349] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.349] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.349] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=241, color=0x19ea80) returned 0x0 [0189.349] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.349] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.349] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=242, color=0x19ea80) returned 0x0 [0189.349] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.349] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.349] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=243, color=0x19ea80) returned 0x0 [0189.349] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.349] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.349] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=244, color=0x19ea80) returned 0x0 [0189.349] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.349] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.349] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=245, color=0x19ea80) returned 0x0 [0189.350] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.350] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.350] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=246, color=0x19ea80) returned 0x0 [0189.350] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.350] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.350] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=247, color=0x19ea80) returned 0x0 [0189.350] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.350] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.350] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=248, color=0x19ea80) returned 0x0 [0189.350] GdipGetImageWidth (image=0x5bbf268, width=0x19ea70) returned 0x0 [0189.350] GdipGetImageHeight (image=0x5bbf268, height=0x19ea70) returned 0x0 [0189.350] GdipBitmapGetPixel (bitmap=0x5bbf268, x=0, y=249, color=0x19ea80) returned 0x0 [0189.880] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x94400, lpName=0x0) returned 0x300 [0189.881] memcpy (in: _Dst=0x7b70000, _Src=0x3510490, _Size=0x94400 | out: _Dst=0x7b70000) returned 0x7b70000 [0189.894] CloseHandle (hObject=0x300) returned 1 [0194.292] CoTaskMemAlloc (cb=0xd) returned 0x83a980 [0194.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22fedb8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0194.293] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0194.294] CoTaskMemFree (pv=0x83a980) [0194.334] CoTaskMemAlloc (cb=0x11) returned 0x803720 [0194.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResumeThread", cchWideChar=12, lpMultiByteStr=0x22ff0f4, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResumeThread", lpUsedDefaultChar=0x0) returned 12 [0194.335] GetProcAddress (hModule=0x74580000, lpProcName="ResumeThread") returned 0x7459a800 [0194.335] CoTaskMemFree (pv=0x803720) [0194.384] CoTaskMemAlloc (cb=0xd) returned 0x83a8a8 [0194.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22ff878, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0194.385] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0194.392] CoTaskMemFree (pv=0x83a8a8) [0194.392] CoTaskMemAlloc (cb=0x1a) returned 0x7fe348 [0194.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64SetThreadContext", cchWideChar=21, lpMultiByteStr=0x22ff8b0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64SetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0194.394] GetProcAddress (hModule=0x74580000, lpProcName="Wow64SetThreadContext") returned 0x745c3e60 [0194.395] CoTaskMemFree (pv=0x7fe348) [0194.413] CoTaskMemAlloc (cb=0xd) returned 0x83a8f0 [0194.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22ff97c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0194.413] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0194.413] CoTaskMemFree (pv=0x83a8f0) [0194.413] CoTaskMemAlloc (cb=0x15) returned 0x803720 [0194.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetThreadContext", cchWideChar=16, lpMultiByteStr=0x22ff9b4, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0194.414] GetProcAddress (hModule=0x74580000, lpProcName="SetThreadContext") returned 0x745c2490 [0194.414] CoTaskMemFree (pv=0x803720) [0194.418] CoTaskMemAlloc (cb=0xd) returned 0x83a980 [0194.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22ffa7c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0194.418] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0194.418] CoTaskMemFree (pv=0x83a980) [0194.418] CoTaskMemAlloc (cb=0x1a) returned 0x7fe168 [0194.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64GetThreadContext", cchWideChar=21, lpMultiByteStr=0x22ffab4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64GetThreadContext", lpUsedDefaultChar=0x0) returned 21 [0194.419] GetProcAddress (hModule=0x74580000, lpProcName="Wow64GetThreadContext") returned 0x745c3e30 [0194.419] CoTaskMemFree (pv=0x7fe168) [0194.423] CoTaskMemAlloc (cb=0xd) returned 0x83a7b8 [0194.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22ffb80, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0194.423] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0194.423] CoTaskMemFree (pv=0x83a7b8) [0194.423] CoTaskMemAlloc (cb=0x15) returned 0x803600 [0194.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetThreadContext", cchWideChar=16, lpMultiByteStr=0x22ffbb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThreadContext", lpUsedDefaultChar=0x0) returned 16 [0194.423] GetProcAddress (hModule=0x74580000, lpProcName="GetThreadContext") returned 0x7459ec60 [0194.423] CoTaskMemFree (pv=0x803600) [0194.427] CoTaskMemAlloc (cb=0xd) returned 0x83a800 [0194.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22ffc74, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0194.427] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0194.427] CoTaskMemFree (pv=0x83a800) [0194.427] CoTaskMemAlloc (cb=0x13) returned 0x803820 [0194.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAllocEx", cchWideChar=14, lpMultiByteStr=0x22ffcac, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAllocEx", lpUsedDefaultChar=0x0) returned 14 [0194.427] GetProcAddress (hModule=0x74580000, lpProcName="VirtualAllocEx") returned 0x745c2730 [0194.427] CoTaskMemFree (pv=0x803820) [0194.432] CoTaskMemAlloc (cb=0xd) returned 0x83a7a0 [0194.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22ffd68, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0194.432] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0194.433] CoTaskMemFree (pv=0x83a7a0) [0194.433] CoTaskMemAlloc (cb=0x17) returned 0x803640 [0194.433] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteProcessMemory", cchWideChar=18, lpMultiByteStr=0x22ffda0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteProcessMemory", lpUsedDefaultChar=0x0) returned 18 [0194.433] GetProcAddress (hModule=0x74580000, lpProcName="WriteProcessMemory") returned 0x745c2850 [0194.433] CoTaskMemFree (pv=0x803640) [0194.439] CoTaskMemAlloc (cb=0xd) returned 0x83a980 [0194.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x22ffe64, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0194.439] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0194.439] CoTaskMemFree (pv=0x83a980) [0194.439] CoTaskMemAlloc (cb=0x16) returned 0x803720 [0194.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReadProcessMemory", cchWideChar=17, lpMultiByteStr=0x22ffe9c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadProcessMemory", lpUsedDefaultChar=0x0) returned 17 [0194.439] GetProcAddress (hModule=0x74580000, lpProcName="ReadProcessMemory") returned 0x745c1c80 [0194.440] CoTaskMemFree (pv=0x803720) [0194.451] CoTaskMemAlloc (cb=0xa) returned 0x83a710 [0194.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x22fff5c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5 [0194.451] LoadLibraryA (lpLibFileName="ntdll") returned 0x77830000 [0194.451] CoTaskMemFree (pv=0x83a710) [0194.451] CoTaskMemAlloc (cb=0x19) returned 0x7fe2f8 [0194.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZwUnmapViewOfSection", cchWideChar=20, lpMultiByteStr=0x22fff88, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZwUnmapViewOfSection", lpUsedDefaultChar=0x0) returned 20 [0194.451] GetProcAddress (hModule=0x77830000, lpProcName="ZwUnmapViewOfSection") returned 0x778a6f40 [0194.452] CoTaskMemFree (pv=0x7fe2f8) [0194.455] CoTaskMemAlloc (cb=0xd) returned 0x83a980 [0194.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2300050, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0194.455] LoadLibraryA (lpLibFileName="kernel32") returned 0x74580000 [0194.455] CoTaskMemFree (pv=0x83a980) [0194.455] CoTaskMemAlloc (cb=0x13) returned 0x803820 [0194.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateProcessA", cchWideChar=14, lpMultiByteStr=0x2300088, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateProcessA", lpUsedDefaultChar=0x0) returned 14 [0194.456] GetProcAddress (hModule=0x74580000, lpProcName="CreateProcessA") returned 0x745c0750 [0194.456] CoTaskMemFree (pv=0x803820) [0194.514] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe", nBufferLength=0x105, lpBuffer=0x19e0e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe", lpFilePart=0x0) returned 0x62 [0194.524] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="mwyLJQTCzoERzESbkqhGjwVkw") returned 0x0 [0194.553] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="mwyLJQTCzoERzESbkqhGjwVkw") returned 0x300 [0195.224] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x62e00, lpName=0x0) returned 0x324 [0195.224] memcpy (in: _Dst=0x7c50000, _Src=0x349eb30, _Size=0x62e00 | out: _Dst=0x7c50000) returned 0x7c50000 [0195.231] CloseHandle (hObject=0x324) returned 1 [0195.360] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe", nBufferLength=0x105, lpBuffer=0x19e028, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\31941c96fa470de35d08fd8bdc215c2ff2cbeb82dd72e91aafa563c08af7c969.exe", lpFilePart=0x0) returned 0x62 [0195.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19dac0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0195.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", cchWideChar=57, lpMultiByteStr=0x19e2e4, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\x86Ð\x07l\x9bÂà «\"k|ê\x19", lpUsedDefaultChar=0x0) returned 57 [0195.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x19e2e0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ì\x86Ð\x07C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpUsedDefaultChar=0x0) returned 0 [0195.441] CreateProcessA (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19e37c*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19e610 | out: lpCommandLine="", lpProcessInformation=0x19e610*(hProcess=0x328, hThread=0x324, dwProcessId=0x12b0, dwThreadId=0x2fc)) returned 1 [0195.494] CoTaskMemFree (pv=0x0) [0195.505] GetThreadContext (in: hThread=0x324, lpContext=0x22f3964 | out: lpContext=0x22f3964*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x3ec000, Edx=0x0, Ecx=0x0, Eax=0x439422, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0195.505] ReadProcessMemory (in: hProcess=0x328, lpBaseAddress=0x3ec008, lpBuffer=0x19e600, nSize=0x4, lpNumberOfBytesRead=0x19e644 | out: lpBuffer=0x19e600*, lpNumberOfBytesRead=0x19e644*=0x4) returned 1 [0195.506] NtUnmapViewOfSection (ProcessHandle=0x328, BaseAddress=0x400000) returned 0x0 [0195.509] VirtualAllocEx (hProcess=0x328, lpAddress=0x400000, dwSize=0x66000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0195.513] WriteProcessMemory (in: hProcess=0x328, lpBaseAddress=0x400000, lpBuffer=0x36058d0*, nSize=0x200, lpNumberOfBytesWritten=0x19e644 | out: lpBuffer=0x36058d0*, lpNumberOfBytesWritten=0x19e644*=0x200) returned 1 [0195.539] WriteProcessMemory (in: hProcess=0x328, lpBaseAddress=0x402000, lpBuffer=0x36668f0*, nSize=0x34000, lpNumberOfBytesWritten=0x19e644 | out: lpBuffer=0x36668f0*, lpNumberOfBytesWritten=0x19e644*=0x34000) returned 1 [0195.565] WriteProcessMemory (in: hProcess=0x328, lpBaseAddress=0x436000, lpBuffer=0x369a910*, nSize=0x2cc00, lpNumberOfBytesWritten=0x19e644 | out: lpBuffer=0x369a910*, lpNumberOfBytesWritten=0x19e644*=0x2cc00) returned 1 [0195.606] WriteProcessMemory (in: hProcess=0x328, lpBaseAddress=0x464000, lpBuffer=0x225c6ec*, nSize=0x200, lpNumberOfBytesWritten=0x19e644 | out: lpBuffer=0x225c6ec*, lpNumberOfBytesWritten=0x19e644*=0x200) returned 1 [0195.621] WriteProcessMemory (in: hProcess=0x328, lpBaseAddress=0x3ec008, lpBuffer=0x225cd10*, nSize=0x4, lpNumberOfBytesWritten=0x19e644 | out: lpBuffer=0x225cd10*, lpNumberOfBytesWritten=0x19e644*=0x4) returned 1 [0195.624] SetThreadContext (hThread=0x324, lpContext=0x22f3964*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x3ec000, Edx=0x0, Ecx=0x0, Eax=0x435f7e, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0195.625] ResumeThread (hThread=0x324) returned 0x1 [0195.752] CoGetContextToken (in: pToken=0x19e9e8 | out: pToken=0x19e9e8) returned 0x0 [0195.752] CObjectContext::QueryInterface () returned 0x0 [0195.753] CObjectContext::GetCurrentThreadType () returned 0x0 [0195.753] Release () returned 0x0 [0195.755] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x7d8418*=0x14c, lpdwindex=0x19e88c | out: lpdwindex=0x19e88c) returned 0x0 Thread: id = 2 os_tid = 0x2d0 Thread: id = 3 os_tid = 0x898 Thread: id = 4 os_tid = 0xec [0130.216] CoGetContextToken (in: pToken=0x432fc3c | out: pToken=0x432fc3c) returned 0x800401f0 [0130.216] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0130.216] RoInitialize () returned 0x1 [0130.217] RoUninitialize () returned 0x0 [0195.816] SetWindowLongW (hWnd=0x70228, nIndex=-4, dwNewLong=1951270880) returned 78251494 [0195.820] SetClassLongW (hWnd=0x70228, nIndex=-24, dwNewLong=1951270880) returned 0x4aa05be [0195.820] PostMessageW (hWnd=0x70228, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0195.821] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0195.822] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", hInstance=0x400000) returned 0 [0195.833] IsWindow (hWnd=0x502ec) returned 1 [0195.836] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75640000 [0195.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x432f9dc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWÚkl\x9bÂà «\"kXü2\x048y\x7f", lpUsedDefaultChar=0x0) returned 14 [0195.836] GetProcAddress (hModule=0x75640000, lpProcName="DefWindowProcW") returned 0x744e07e0 [0195.837] SetWindowLongW (hWnd=0x502ec, nIndex=-4, dwNewLong=1951270880) returned 78251574 [0195.837] SetClassLongW (hWnd=0x502ec, nIndex=-24, dwNewLong=1951270880) returned 0x4aa0636 [0195.837] IsWindow (hWnd=0x502ec) returned 1 [0195.838] DestroyWindow (hWnd=0x502ec) returned 0 [0195.838] PostMessageW (hWnd=0x502ec, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0195.838] SetConsoleCtrlHandler (HandlerRoutine=0x4aa060e, Add=0) returned 1 [0195.838] EtwEventUnregister (RegHandle=0x808cc0) returned 0x0 [0195.869] CloseHandle (hObject=0x270) returned 1 [0195.871] GdipDeleteFont (font=0x4a1efc0) returned 0x0 [0195.872] GdipDisposeImage (image=0x5bbf268) returned 0x0 [0195.896] GdipDeleteFont (font=0x4a11f08) returned 0x0 [0195.897] DeleteObject (ho=0x320a07b7) returned 1 [0195.899] RestoreDC (hdc=0x40010682, nSavedDC=-1) returned 1 [0195.901] DeleteDC (hdc=0x40010682) returned 1 [0195.902] DeleteObject (ho=0x300a07b4) returned 1 [0195.903] DeleteObject (ho=0x430a0951) returned 1 [0195.914] CloseHandle (hObject=0x300) returned 1 [0195.915] RegCloseKey (hKey=0x80000004) returned 0x0 Thread: id = 5 os_tid = 0xfc4 Thread: id = 6 os_tid = 0xa88 Thread: id = 7 os_tid = 0xd74 Thread: id = 8 os_tid = 0x528 Thread: id = 9 os_tid = 0x12ac [0194.587] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0194.588] RoInitialize () returned 0x1 [0194.588] RoUninitialize () returned 0x0 [0194.619] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x7e0f1ec | out: lpLuid=0x7e0f1ec*(LowPart=0x14, HighPart=0)) returned 1 [0194.622] GetCurrentProcess () returned 0xffffffff [0194.622] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x7e0f1e8 | out: TokenHandle=0x7e0f1e8*=0x324) returned 1 [0194.623] AdjustTokenPrivileges (in: TokenHandle=0x324, DisableAllPrivileges=0, NewState=0x230d21c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0194.623] CloseHandle (hObject=0x324) returned 1 [0194.635] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x32c5e10, Length=0x20000, ResultLength=0x7e0f8c8 | out: SystemInformation=0x32c5e10, ResultLength=0x7e0f8c8*=0x17058) returned 0x0 Thread: id = 11 os_tid = 0x238 Thread: id = 12 os_tid = 0xb88 [0195.733] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0195.733] RoInitialize () returned 0x1 [0195.733] RoUninitialize () returned 0x0 [0195.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x32c5e10, Length=0x20000, ResultLength=0x814f7c8 | out: SystemInformation=0x32c5e10, ResultLength=0x814f7c8*=0x172d0) returned 0x0 Thread: id = 14 os_tid = 0xb80 Thread: id = 15 os_tid = 0xb84 Process: id = "2" image_name = "msbuild.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe" page_root = "0x6cc06000" os_pid = "0x12b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x76c" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fe14" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 656 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 657 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 658 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 659 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 660 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 661 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 662 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 663 start_va = 0x400000 end_va = 0x43ffff monitored = 0 entry_point = 0x439422 region_type = mapped_file name = "msbuild.exe" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe") Region: id = 664 start_va = 0x77830000 end_va = 0x779aafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 665 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 666 start_va = 0xfffb0000 end_va = 0xfffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000fffb0000" filename = "" Region: id = 667 start_va = 0xfffe0000 end_va = 0x7ffdab58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 668 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 669 start_va = 0x7ffdab751000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffdab751000" filename = "" Region: id = 670 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 671 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 672 start_va = 0x400000 end_va = 0x465fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 675 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 676 start_va = 0x639e0000 end_va = 0x63a2ffff monitored = 0 entry_point = 0x639f8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 677 start_va = 0x63a40000 end_va = 0x63ab9fff monitored = 0 entry_point = 0x63a53290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 678 start_va = 0x74580000 end_va = 0x7465ffff monitored = 0 entry_point = 0x74593980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 679 start_va = 0x63a30000 end_va = 0x63a37fff monitored = 0 entry_point = 0x63a317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 680 start_va = 0x610000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 681 start_va = 0x6cd80000 end_va = 0x6cdd8fff monitored = 1 entry_point = 0x6cd90780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 682 start_va = 0x74580000 end_va = 0x7465ffff monitored = 0 entry_point = 0x74593980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 683 start_va = 0x77420000 end_va = 0x7759dfff monitored = 0 entry_point = 0x774d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 684 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 685 start_va = 0xffeb0000 end_va = 0xfffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000ffeb0000" filename = "" Region: id = 686 start_va = 0x470000 end_va = 0x52dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 687 start_va = 0x610000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 688 start_va = 0x7d0000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 689 start_va = 0x7fff0000 end_va = 0x7fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 690 start_va = 0x80000000 end_va = 0x8000ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000080000000" filename = "" Region: id = 691 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 692 start_va = 0x74810000 end_va = 0x7488afff monitored = 0 entry_point = 0x7482e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 693 start_va = 0x74db0000 end_va = 0x74e6dfff monitored = 0 entry_point = 0x74de5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 694 start_va = 0x530000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 695 start_va = 0x610000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 696 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 701 start_va = 0x757e0000 end_va = 0x75823fff monitored = 0 entry_point = 0x757f9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 702 start_va = 0x759b0000 end_va = 0x75a5cfff monitored = 0 entry_point = 0x759c4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 703 start_va = 0x74560000 end_va = 0x7457dfff monitored = 0 entry_point = 0x7456b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 704 start_va = 0x74550000 end_va = 0x74559fff monitored = 0 entry_point = 0x74552a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 705 start_va = 0x777d0000 end_va = 0x77827fff monitored = 0 entry_point = 0x778125c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 706 start_va = 0x8d0000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 707 start_va = 0x6cd00000 end_va = 0x6cd78fff monitored = 1 entry_point = 0x6cd0f82a region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 708 start_va = 0x77680000 end_va = 0x776c4fff monitored = 0 entry_point = 0x7769de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 709 start_va = 0x75bf0000 end_va = 0x75dacfff monitored = 0 entry_point = 0x75cd2a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 710 start_va = 0x771b0000 end_va = 0x772fefff monitored = 0 entry_point = 0x77266820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 711 start_va = 0x75640000 end_va = 0x75786fff monitored = 0 entry_point = 0x75651cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 712 start_va = 0x1d0000 end_va = 0x1f9fff monitored = 0 entry_point = 0x1d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 713 start_va = 0x8d0000 end_va = 0xa57fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 714 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 715 start_va = 0x77740000 end_va = 0x7776afff monitored = 0 entry_point = 0x77745680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 716 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 717 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 718 start_va = 0xa90000 end_va = 0xc10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 719 start_va = 0xc20000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c20000" filename = "" Region: id = 720 start_va = 0x77730000 end_va = 0x7773bfff monitored = 0 entry_point = 0x77733930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 723 start_va = 0x6d230000 end_va = 0x6d237fff monitored = 0 entry_point = 0x6d2317b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 724 start_va = 0x6b220000 end_va = 0x6b8d0fff monitored = 1 entry_point = 0x6b235d20 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 725 start_va = 0x6cc00000 end_va = 0x6ccf4fff monitored = 0 entry_point = 0x6cc54160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 726 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 727 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 728 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 729 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 730 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 731 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 732 start_va = 0x5b0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 733 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 734 start_va = 0x5d0000 end_va = 0x5d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 735 start_va = 0x2020000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 736 start_va = 0x2020000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 737 start_va = 0x2160000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 738 start_va = 0x710000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 739 start_va = 0x2170000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 740 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 741 start_va = 0x2270000 end_va = 0x426ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 742 start_va = 0x2020000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 743 start_va = 0x20d0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 744 start_va = 0x780000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 745 start_va = 0x4270000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 746 start_va = 0x4370000 end_va = 0x46a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 747 start_va = 0x69ff0000 end_va = 0x6b217fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll") Region: id = 748 start_va = 0x753d0000 end_va = 0x754bafff monitored = 0 entry_point = 0x7540d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 749 start_va = 0x46b0000 end_va = 0x4740fff monitored = 0 entry_point = 0x46e8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 750 start_va = 0x70610000 end_va = 0x70684fff monitored = 0 entry_point = 0x70649a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 751 start_va = 0x46b0000 end_va = 0x475ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046b0000" filename = "" Region: id = 752 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 753 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 754 start_va = 0x6cb80000 end_va = 0x6cbfdfff monitored = 1 entry_point = 0x6cb81140 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 755 start_va = 0x74660000 end_va = 0x746f1fff monitored = 0 entry_point = 0x74698cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 756 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 757 start_va = 0x6bba0000 end_va = 0x6c54bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll") Region: id = 758 start_va = 0x6c9c0000 end_va = 0x6cb4cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\system.drawing.ni.dll") Region: id = 759 start_va = 0x69390000 end_va = 0x69fe8fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8cd2187094ba6cade0ca0fab4f932654\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\8cd2187094ba6cade0ca0fab4f932654\\system.windows.forms.ni.dll") Region: id = 760 start_va = 0x68c70000 end_va = 0x69381fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll") Region: id = 761 start_va = 0x6c8d0000 end_va = 0x6c9befff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\1b51e779650e38bb712f3e535efcf132\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\1b51e779650e38bb712f3e535efcf132\\system.configuration.ni.dll") Region: id = 762 start_va = 0x68550000 end_va = 0x68c65fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\1f87b5140145c221b5201351fffc52d8\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\1f87b5140145c221b5201351fffc52d8\\system.xml.ni.dll") Region: id = 763 start_va = 0x46b0000 end_va = 0x473ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046b0000" filename = "" Region: id = 764 start_va = 0x4750000 end_va = 0x475ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004750000" filename = "" Region: id = 765 start_va = 0x5e430000 end_va = 0x5e4cbfff monitored = 1 entry_point = 0x5e4be9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 766 start_va = 0x4760000 end_va = 0x47fbfff monitored = 1 entry_point = 0x47ee9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 767 start_va = 0x4800000 end_va = 0x489bfff monitored = 1 entry_point = 0x488e9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 768 start_va = 0x4800000 end_va = 0x48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 769 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 770 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 771 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 772 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 773 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 774 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 775 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 776 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 777 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 778 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 779 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 780 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 781 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 782 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 783 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 784 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 785 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 786 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 787 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 788 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 789 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 790 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 791 start_va = 0x75db0000 end_va = 0x771aefff monitored = 0 entry_point = 0x75f6b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 792 start_va = 0x77640000 end_va = 0x77676fff monitored = 0 entry_point = 0x77643b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 793 start_va = 0x74ed0000 end_va = 0x753c8fff monitored = 0 entry_point = 0x750d7610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 794 start_va = 0x77390000 end_va = 0x7741cfff monitored = 0 entry_point = 0x773d9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 795 start_va = 0x74e70000 end_va = 0x74eb3fff monitored = 0 entry_point = 0x74e77410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 796 start_va = 0x77320000 end_va = 0x7732efff monitored = 0 entry_point = 0x77322e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 797 start_va = 0x760000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 798 start_va = 0x74200000 end_va = 0x7421afff monitored = 0 entry_point = 0x74209050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 799 start_va = 0x70410000 end_va = 0x70422fff monitored = 0 entry_point = 0x70419950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 800 start_va = 0x703e0000 end_va = 0x7040efff monitored = 0 entry_point = 0x703f95e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 801 start_va = 0x20e0000 end_va = 0x211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 802 start_va = 0x2120000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 803 start_va = 0x46b0000 end_va = 0x46effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046b0000" filename = "" Region: id = 804 start_va = 0x4730000 end_va = 0x473ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004730000" filename = "" Region: id = 805 start_va = 0x4900000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 806 start_va = 0x4a00000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 807 start_va = 0x4b00000 end_va = 0x4bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 808 start_va = 0xa60000 end_va = 0xa60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 809 start_va = 0x74d20000 end_va = 0x74da3fff monitored = 0 entry_point = 0x74d46220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 810 start_va = 0xa70000 end_va = 0xa70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a70000" filename = "" Region: id = 811 start_va = 0x6c880000 end_va = 0x6c8c1fff monitored = 1 entry_point = 0x6c88f380 region_type = mapped_file name = "wbemdisp.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.dll") Region: id = 812 start_va = 0x6c810000 end_va = 0x6c876fff monitored = 0 entry_point = 0x6c82b610 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 813 start_va = 0x75b90000 end_va = 0x75beefff monitored = 0 entry_point = 0x75b94af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 814 start_va = 0x6d220000 end_va = 0x6d22cfff monitored = 0 entry_point = 0x6d223520 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 815 start_va = 0x6ce00000 end_va = 0x6ce1bfff monitored = 0 entry_point = 0x6ce0aa90 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 1186 start_va = 0x6cde0000 end_va = 0x6cdf0fff monitored = 0 entry_point = 0x6cde8fa0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 1187 start_va = 0x6bae0000 end_va = 0x6bb9efff monitored = 0 entry_point = 0x6bb11e80 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 1188 start_va = 0x6ba50000 end_va = 0x6bad0fff monitored = 0 entry_point = 0x6ba6b260 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 1189 start_va = 0x20c0000 end_va = 0x20cefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wbemdisp.tlb" filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.tlb" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.tlb") Region: id = 1190 start_va = 0x46f0000 end_va = 0x46f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000046f0000" filename = "" Region: id = 1191 start_va = 0x4700000 end_va = 0x4700fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004700000" filename = "" Region: id = 1192 start_va = 0x4c00000 end_va = 0x4cdffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1193 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1194 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1195 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1196 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1197 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1198 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1199 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1200 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1201 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1202 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1203 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1204 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1205 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1206 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1207 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1208 start_va = 0x4720000 end_va = 0x472ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 1209 start_va = 0x4720000 end_va = 0x472ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 1210 start_va = 0x4720000 end_va = 0x472ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 1211 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1212 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1213 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1214 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1215 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1216 start_va = 0x4710000 end_va = 0x471ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 1306 start_va = 0x6c7f0000 end_va = 0x6c807fff monitored = 1 entry_point = 0x6c7f5480 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1307 start_va = 0x4710000 end_va = 0x4727fff monitored = 1 entry_point = 0x4715480 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1308 start_va = 0x4740000 end_va = 0x474ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004740000" filename = "" Region: id = 1309 start_va = 0x6c7f0000 end_va = 0x6c807fff monitored = 1 entry_point = 0x6c7f5480 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1310 start_va = 0x4ce0000 end_va = 0x4cf7fff monitored = 1 entry_point = 0x4ce5480 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1311 start_va = 0x4ce0000 end_va = 0x4ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ce0000" filename = "" Region: id = 1312 start_va = 0x4cf0000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 1313 start_va = 0x4cf0000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 1315 start_va = 0x4cf0000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 1316 start_va = 0x4cf0000 end_va = 0x4cf1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004cf0000" filename = "" Region: id = 1317 start_va = 0x4cf0000 end_va = 0x4cf4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb") Region: id = 1318 start_va = 0x4d00000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1319 start_va = 0x4d00000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1320 start_va = 0x4d00000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1321 start_va = 0x4d00000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1322 start_va = 0x4d00000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1323 start_va = 0x4d00000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1324 start_va = 0x4d00000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1325 start_va = 0x4d00000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1326 start_va = 0x4d00000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1327 start_va = 0x4d00000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1328 start_va = 0x4d00000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1329 start_va = 0x4d00000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1330 start_va = 0x4d10000 end_va = 0x4d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d10000" filename = "" Region: id = 1331 start_va = 0x4d10000 end_va = 0x4d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d10000" filename = "" Region: id = 1332 start_va = 0x4d10000 end_va = 0x4d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d10000" filename = "" Region: id = 1333 start_va = 0x6b930000 end_va = 0x6ba4bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\d2f554a0c84513cd793fdcd77a86dab1\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\d2f554a0c84513cd793fdcd77a86dab1\\system.management.ni.dll") Region: id = 1334 start_va = 0x4d00000 end_va = 0x4d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1335 start_va = 0x4d40000 end_va = 0x4e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d40000" filename = "" Region: id = 1336 start_va = 0xffe60000 end_va = 0xffeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000ffe60000" filename = "" Region: id = 1337 start_va = 0xffe50000 end_va = 0xffe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000ffe50000" filename = "" Region: id = 1338 start_va = 0x4e40000 end_va = 0x4e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e40000" filename = "" Region: id = 1339 start_va = 0x4e80000 end_va = 0x4f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e80000" filename = "" Region: id = 1340 start_va = 0x6c7e0000 end_va = 0x6c7e9fff monitored = 1 entry_point = 0x6c7e39f9 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 1341 start_va = 0x4f80000 end_va = 0x4f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 1342 start_va = 0x4f80000 end_va = 0x4f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 1343 start_va = 0x4f80000 end_va = 0x4f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 1345 start_va = 0x4f80000 end_va = 0x4f84fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f80000" filename = "" Region: id = 1768 start_va = 0x4f80000 end_va = 0x4f82fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f80000" filename = "" Region: id = 1769 start_va = 0x4f80000 end_va = 0x4fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 1770 start_va = 0x4fc0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fc0000" filename = "" Region: id = 1772 start_va = 0x4f80000 end_va = 0x4f92fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f80000" filename = "" Region: id = 1788 start_va = 0x4f80000 end_va = 0x4f82fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f80000" filename = "" Region: id = 1789 start_va = 0x4f80000 end_va = 0x4f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 1790 start_va = 0x4f80000 end_va = 0x4f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 1791 start_va = 0x4f80000 end_va = 0x4f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 1792 start_va = 0x4f80000 end_va = 0x4fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 1793 start_va = 0x4fc0000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fc0000" filename = "" Region: id = 1794 start_va = 0x5000000 end_va = 0x500ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005000000" filename = "" Region: id = 1795 start_va = 0x705a0000 end_va = 0x705c7fff monitored = 0 entry_point = 0x705a7820 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 1796 start_va = 0x5000000 end_va = 0x503ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005000000" filename = "" Region: id = 1797 start_va = 0x5040000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005040000" filename = "" Region: id = 1798 start_va = 0x5140000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1799 start_va = 0x5180000 end_va = 0x51bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1800 start_va = 0x684d0000 end_va = 0x68540fff monitored = 0 entry_point = 0x685269e0 region_type = mapped_file name = "efswrt.dll" filename = "\\Windows\\SysWOW64\\efswrt.dll" (normalized: "c:\\windows\\syswow64\\efswrt.dll") Region: id = 1801 start_va = 0x74130000 end_va = 0x741f7fff monitored = 0 entry_point = 0x7419ae90 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 1802 start_va = 0x51c0000 end_va = 0x51c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 1803 start_va = 0x6b8e0000 end_va = 0x6b928fff monitored = 0 entry_point = 0x6b8e6450 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\SysWOW64\\edputil.dll" (normalized: "c:\\windows\\syswow64\\edputil.dll") Region: id = 1804 start_va = 0x51d0000 end_va = 0x52cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 1805 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1806 start_va = 0x52e0000 end_va = 0x52effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 1807 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1808 start_va = 0x52e0000 end_va = 0x52effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 1809 start_va = 0x52f0000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 1810 start_va = 0x5300000 end_va = 0x530ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005300000" filename = "" Region: id = 1811 start_va = 0x5310000 end_va = 0x531ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005310000" filename = "" Region: id = 1812 start_va = 0x5320000 end_va = 0x532ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005320000" filename = "" Region: id = 1813 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1814 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1815 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1816 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1817 start_va = 0x52e0000 end_va = 0x52effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 1818 start_va = 0x52e0000 end_va = 0x52effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 1819 start_va = 0x52e0000 end_va = 0x52effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 1820 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1821 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1822 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1823 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1824 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1825 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1826 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1827 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1828 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1829 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1830 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1831 start_va = 0x52e0000 end_va = 0x52effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 1832 start_va = 0x52e0000 end_va = 0x52effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 1833 start_va = 0x52e0000 end_va = 0x52effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 1834 start_va = 0x52e0000 end_va = 0x52effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 1835 start_va = 0x52e0000 end_va = 0x52effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 1836 start_va = 0x52f0000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 1837 start_va = 0x5300000 end_va = 0x530ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005300000" filename = "" Region: id = 1838 start_va = 0x5310000 end_va = 0x531ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005310000" filename = "" Region: id = 1839 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1840 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1841 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1842 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1843 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1844 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1845 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1846 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1847 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1848 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1849 start_va = 0x52e0000 end_va = 0x52effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 1850 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1851 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1852 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1853 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1854 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1855 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1856 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1857 start_va = 0x52f0000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 1858 start_va = 0x52f0000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 1859 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1860 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1861 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1862 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1863 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1864 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1865 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1866 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1867 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1868 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1869 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1870 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1871 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1872 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1873 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1874 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1875 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1876 start_va = 0x52f0000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 1877 start_va = 0x52f0000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 1878 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1879 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1880 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1881 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1882 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1883 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1884 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1885 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1886 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1887 start_va = 0x52f0000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 1888 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1889 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1890 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1891 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1892 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1893 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1894 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1895 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1896 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1897 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1898 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1899 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1900 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1901 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1902 start_va = 0x52f0000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 1903 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1904 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1905 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1906 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1907 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1908 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1909 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1910 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1911 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1912 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1913 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 1914 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1915 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1916 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1917 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1918 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1919 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1920 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1921 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1922 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1923 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1924 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1925 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 1926 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1927 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1928 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1929 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1930 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1931 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1932 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1933 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1934 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1935 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1936 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 1937 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1938 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1939 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1940 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1941 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1942 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1943 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1944 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1945 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1946 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1947 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1948 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1949 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1950 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1951 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1952 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1953 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1954 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1955 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1956 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1957 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1958 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1959 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1960 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1961 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 1962 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 1963 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1964 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 1965 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 1966 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1967 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1968 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1969 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1970 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1971 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1972 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1973 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1974 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 1975 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 1976 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 1977 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 1978 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1979 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1980 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1981 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1982 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1983 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1984 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1985 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1986 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1987 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1988 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1989 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1990 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1991 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1992 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1993 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1994 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1995 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1996 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1997 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1998 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 1999 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2000 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2001 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2002 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2003 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2004 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2005 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2006 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2007 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2008 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2009 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2010 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2011 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2012 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2013 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2014 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2015 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2016 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2017 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2018 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2019 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2020 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2021 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2022 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2023 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2024 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2025 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2026 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2027 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2028 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2029 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2030 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2031 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2032 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2033 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2034 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2035 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2036 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2037 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2038 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2039 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2040 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2041 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2042 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2043 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2044 start_va = 0x5140000 end_va = 0x514ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2045 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2046 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2047 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2048 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2049 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2050 start_va = 0x5150000 end_va = 0x5150fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 2051 start_va = 0x5150000 end_va = 0x5158fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 2052 start_va = 0x5150000 end_va = 0x5150fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 2053 start_va = 0x5150000 end_va = 0x5158fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 2054 start_va = 0x5150000 end_va = 0x5150fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 2055 start_va = 0x5150000 end_va = 0x5158fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 2056 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2057 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2058 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2059 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2060 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2061 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2062 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2063 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2064 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2065 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2066 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2067 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2068 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2069 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2070 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2071 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 2072 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2073 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2074 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2075 start_va = 0x5150000 end_va = 0x515ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 2076 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2077 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2078 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2079 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2080 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2081 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2082 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2083 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2084 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2085 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2086 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2087 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2088 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2089 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2090 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2091 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2092 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2093 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2094 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2095 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2096 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2097 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2098 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2099 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 2100 start_va = 0x5190000 end_va = 0x519ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005190000" filename = "" Region: id = 2101 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2102 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2103 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2104 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2105 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2106 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2107 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2108 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2109 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2110 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2111 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2112 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2113 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2114 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2115 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2116 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 2117 start_va = 0x5190000 end_va = 0x519ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005190000" filename = "" Region: id = 2118 start_va = 0x51a0000 end_va = 0x51affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051a0000" filename = "" Region: id = 2119 start_va = 0x51b0000 end_va = 0x51bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051b0000" filename = "" Region: id = 2120 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2121 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2122 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2123 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2124 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2125 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2126 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2127 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2128 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2129 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2130 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2131 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2132 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2133 start_va = 0x52f0000 end_va = 0x5351fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 2134 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2135 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2136 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2137 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2138 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2139 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2140 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2141 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2142 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2143 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2144 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2145 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2146 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2147 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 2148 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2149 start_va = 0x6d250000 end_va = 0x6d289fff monitored = 0 entry_point = 0x6d269be0 region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\SysWOW64\\vaultcli.dll" (normalized: "c:\\windows\\syswow64\\vaultcli.dll") Region: id = 2150 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2151 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2152 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2153 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2154 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2155 start_va = 0x5180000 end_va = 0x518ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 2156 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2157 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2158 start_va = 0x5170000 end_va = 0x517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005170000" filename = "" Region: id = 2159 start_va = 0x68410000 end_va = 0x684c5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Security\\4e4cb6e2e651b6d243241e4edd14b3f3\\System.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.security\\4e4cb6e2e651b6d243241e4edd14b3f3\\system.security.ni.dll") Region: id = 2160 start_va = 0x75830000 end_va = 0x759a7fff monitored = 0 entry_point = 0x75888a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 2161 start_va = 0x754c0000 end_va = 0x754cdfff monitored = 0 entry_point = 0x754c5410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 2162 start_va = 0x70430000 end_va = 0x70437fff monitored = 0 entry_point = 0x70431d70 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\SysWOW64\\dpapi.dll" (normalized: "c:\\windows\\syswow64\\dpapi.dll") Region: id = 2163 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2164 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2165 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2166 start_va = 0x5160000 end_va = 0x516ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2167 start_va = 0x5360000 end_va = 0x539ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005360000" filename = "" Region: id = 2168 start_va = 0x53a0000 end_va = 0x549ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053a0000" filename = "" Region: id = 2169 start_va = 0x20c0000 end_va = 0x20c2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020c0000" filename = "" Region: id = 2170 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2171 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2172 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2173 start_va = 0x5160000 end_va = 0x519ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2174 start_va = 0x5360000 end_va = 0x545ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005360000" filename = "" Region: id = 2178 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2179 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2180 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2181 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2182 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2183 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2184 start_va = 0x5160000 end_va = 0x519ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2185 start_va = 0x5360000 end_va = 0x545ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005360000" filename = "" Region: id = 2188 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2189 start_va = 0x4cf0000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 2190 start_va = 0x68360000 end_va = 0x68404fff monitored = 0 entry_point = 0x6837ac50 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 2191 start_va = 0x6c7b0000 end_va = 0x6c7d2fff monitored = 0 entry_point = 0x6c7b5570 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 2192 start_va = 0x68350000 end_va = 0x6835ffff monitored = 0 entry_point = 0x68353820 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 2193 start_va = 0x72040000 end_va = 0x7208efff monitored = 0 entry_point = 0x7204d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 2194 start_va = 0x5160000 end_va = 0x519ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 2195 start_va = 0x5360000 end_va = 0x545ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005360000" filename = "" Region: id = 2196 start_va = 0x706a0000 end_va = 0x7073afff monitored = 0 entry_point = 0x706df7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 2197 start_va = 0x70740000 end_va = 0x70751fff monitored = 0 entry_point = 0x70744510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 2198 start_va = 0x71f80000 end_va = 0x71faefff monitored = 0 entry_point = 0x71f8bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 2199 start_va = 0x74ec0000 end_va = 0x74ec6fff monitored = 0 entry_point = 0x74ec1e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2200 start_va = 0x71f00000 end_va = 0x71f12fff monitored = 0 entry_point = 0x71f025d0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 2201 start_va = 0x71ee0000 end_va = 0x71ef3fff monitored = 0 entry_point = 0x71ee3c10 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 2202 start_va = 0x5460000 end_va = 0x549ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005460000" filename = "" Region: id = 2203 start_va = 0x54a0000 end_va = 0x559ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000054a0000" filename = "" Region: id = 2204 start_va = 0x51a0000 end_va = 0x51b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000051a0000" filename = "" Region: id = 2205 start_va = 0x71fb0000 end_va = 0x72033fff monitored = 0 entry_point = 0x71fd6530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 2206 start_va = 0x70690000 end_va = 0x70697fff monitored = 0 entry_point = 0x70691fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 2207 start_va = 0x71f70000 end_va = 0x71f77fff monitored = 0 entry_point = 0x71f71920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 2208 start_va = 0x71f20000 end_va = 0x71f66fff monitored = 0 entry_point = 0x71f358d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 2209 start_va = 0x6d240000 end_va = 0x6d249fff monitored = 0 entry_point = 0x6d243200 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2210 start_va = 0x704c0000 end_va = 0x70523fff monitored = 0 entry_point = 0x704dafd0 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 2211 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2212 start_va = 0x704b0000 end_va = 0x704bffff monitored = 0 entry_point = 0x704b4600 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll") Region: id = 2213 start_va = 0x70490000 end_va = 0x704affff monitored = 0 entry_point = 0x7049d120 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 2214 start_va = 0x70460000 end_va = 0x7048bfff monitored = 0 entry_point = 0x7047bb10 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll") Region: id = 2215 start_va = 0x70440000 end_va = 0x70459fff monitored = 0 entry_point = 0x7044fa70 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll") Region: id = 2216 start_va = 0x55a0000 end_va = 0x55dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 2217 start_va = 0x55e0000 end_va = 0x56dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 2218 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 2219 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 2220 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 2221 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 2222 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 2223 start_va = 0x75a70000 end_va = 0x75b8efff monitored = 0 entry_point = 0x75ab5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2224 start_va = 0x52d0000 end_va = 0x52dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052d0000" filename = "" Region: id = 2225 start_va = 0x56e0000 end_va = 0x56effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056e0000" filename = "" Region: id = 2226 start_va = 0x52d0000 end_va = 0x52d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052d0000" filename = "" Region: id = 2227 start_va = 0x56e0000 end_va = 0x579bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000056e0000" filename = "" Region: id = 2228 start_va = 0x52d0000 end_va = 0x52d3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052d0000" filename = "" Region: id = 2229 start_va = 0x6fef0000 end_va = 0x6ff0cfff monitored = 0 entry_point = 0x6fef3b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 2230 start_va = 0x57a0000 end_va = 0x57affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057a0000" filename = "" Region: id = 2231 start_va = 0x57a0000 end_va = 0x57affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057a0000" filename = "" Region: id = 2232 start_va = 0x57a0000 end_va = 0x57affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057a0000" filename = "" Region: id = 2233 start_va = 0x57a0000 end_va = 0x57affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057a0000" filename = "" Region: id = 2234 start_va = 0x57a0000 end_va = 0x57affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057a0000" filename = "" Region: id = 2235 start_va = 0x57a0000 end_va = 0x57affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057a0000" filename = "" Region: id = 2236 start_va = 0x57a0000 end_va = 0x581ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057a0000" filename = "" Region: id = 2237 start_va = 0x5820000 end_va = 0x582ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005820000" filename = "" Region: id = 2238 start_va = 0x5820000 end_va = 0x582ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005820000" filename = "" Region: id = 2239 start_va = 0x5820000 end_va = 0x582ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005820000" filename = "" Region: id = 2240 start_va = 0x5820000 end_va = 0x582ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005820000" filename = "" Region: id = 2241 start_va = 0x74800000 end_va = 0x74805fff monitored = 0 entry_point = 0x74801460 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 2242 start_va = 0x5820000 end_va = 0x58aefff monitored = 0 entry_point = 0x582dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 2243 start_va = 0x682b0000 end_va = 0x68341fff monitored = 0 entry_point = 0x682bdd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 2244 start_va = 0x5820000 end_va = 0x58cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005820000" filename = "" Region: id = 2245 start_va = 0x5820000 end_va = 0x5823fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005820000" filename = "" Region: id = 2246 start_va = 0x58c0000 end_va = 0x58cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000058c0000" filename = "" Region: id = 2248 start_va = 0x5830000 end_va = 0x583ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005830000" filename = "" Region: id = 2249 start_va = 0x5830000 end_va = 0x583ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005830000" filename = "" Region: id = 2250 start_va = 0x5830000 end_va = 0x583ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005830000" filename = "" Region: id = 2251 start_va = 0x5830000 end_va = 0x583ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005830000" filename = "" Region: id = 2252 start_va = 0x5830000 end_va = 0x583ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005830000" filename = "" Region: id = 2253 start_va = 0x5830000 end_va = 0x583ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005830000" filename = "" Region: id = 2254 start_va = 0x5840000 end_va = 0x584ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005840000" filename = "" Region: id = 2255 start_va = 0x5850000 end_va = 0x585ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005850000" filename = "" Region: id = 2256 start_va = 0x5860000 end_va = 0x586ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005860000" filename = "" Region: id = 2258 start_va = 0x5000000 end_va = 0x5000fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005000000" filename = "" Region: id = 2259 start_va = 0x5010000 end_va = 0x5010fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005010000" filename = "" Thread: id = 10 os_tid = 0x2fc [0196.833] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0196.859] RoInitialize () returned 0x1 [0196.859] RoUninitialize () returned 0x0 [0197.459] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x230 [0197.460] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x234 [0197.490] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e60c | out: phkResult=0x19e60c*=0x244) returned 0x0 [0197.491] RegQueryValueExW (in: hKey=0x244, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19e62c, lpData=0x0, lpcbData=0x19e628*=0x0 | out: lpType=0x19e62c*=0x1, lpData=0x0, lpcbData=0x19e628*=0xe) returned 0x0 [0197.491] RegQueryValueExW (in: hKey=0x244, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19e62c, lpData=0x2274844, lpcbData=0x19e628*=0xe | out: lpType=0x19e62c*=0x1, lpData="Client", lpcbData=0x19e628*=0xe) returned 0x0 [0197.493] RegCloseKey (hKey=0x244) returned 0x0 [0197.759] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", nBufferLength=0x105, lpBuffer=0x19dfc8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", lpFilePart=0x0) returned 0x40 [0197.762] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", nBufferLength=0x105, lpBuffer=0x19df70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", lpFilePart=0x0) returned 0x40 [0198.269] GetCurrentProcess () returned 0xffffffff [0198.270] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e328 | out: TokenHandle=0x19e328*=0x244) returned 1 [0198.273] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19de04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0198.276] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0198.277] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0198.279] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0198.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19dd60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0198.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e254) returned 1 [0198.282] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x248 [0198.282] GetFileType (hFile=0x248) returned 0x1 [0198.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e250) returned 1 [0198.282] GetFileType (hFile=0x248) returned 0x1 [0198.321] GetFileSize (in: hFile=0x248, lpFileSizeHigh=0x19e31c | out: lpFileSizeHigh=0x19e31c*=0x0) returned 0x8c8f [0198.321] ReadFile (in: hFile=0x248, lpBuffer=0x22784a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e2d8, lpOverlapped=0x0 | out: lpBuffer=0x22784a0*, lpNumberOfBytesRead=0x19e2d8*=0x1000, lpOverlapped=0x0) returned 1 [0198.349] ReadFile (in: hFile=0x248, lpBuffer=0x22784a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e174, lpOverlapped=0x0 | out: lpBuffer=0x22784a0*, lpNumberOfBytesRead=0x19e174*=0x1000, lpOverlapped=0x0) returned 1 [0198.356] ReadFile (in: hFile=0x248, lpBuffer=0x22784a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e028, lpOverlapped=0x0 | out: lpBuffer=0x22784a0*, lpNumberOfBytesRead=0x19e028*=0x1000, lpOverlapped=0x0) returned 1 [0198.357] ReadFile (in: hFile=0x248, lpBuffer=0x22784a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e028, lpOverlapped=0x0 | out: lpBuffer=0x22784a0*, lpNumberOfBytesRead=0x19e028*=0x1000, lpOverlapped=0x0) returned 1 [0198.359] ReadFile (in: hFile=0x248, lpBuffer=0x22784a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e028, lpOverlapped=0x0 | out: lpBuffer=0x22784a0*, lpNumberOfBytesRead=0x19e028*=0x1000, lpOverlapped=0x0) returned 1 [0198.359] ReadFile (in: hFile=0x248, lpBuffer=0x22784a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19df60, lpOverlapped=0x0 | out: lpBuffer=0x22784a0*, lpNumberOfBytesRead=0x19df60*=0x1000, lpOverlapped=0x0) returned 1 [0198.367] ReadFile (in: hFile=0x248, lpBuffer=0x22784a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e0dc, lpOverlapped=0x0 | out: lpBuffer=0x22784a0*, lpNumberOfBytesRead=0x19e0dc*=0x1000, lpOverlapped=0x0) returned 1 [0198.370] ReadFile (in: hFile=0x248, lpBuffer=0x22784a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19dff0, lpOverlapped=0x0 | out: lpBuffer=0x22784a0*, lpNumberOfBytesRead=0x19dff0*=0x1000, lpOverlapped=0x0) returned 1 [0198.370] ReadFile (in: hFile=0x248, lpBuffer=0x22784a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19dff0, lpOverlapped=0x0 | out: lpBuffer=0x22784a0*, lpNumberOfBytesRead=0x19dff0*=0xc8f, lpOverlapped=0x0) returned 1 [0198.370] ReadFile (in: hFile=0x248, lpBuffer=0x22784a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e0b0, lpOverlapped=0x0 | out: lpBuffer=0x22784a0*, lpNumberOfBytesRead=0x19e0b0*=0x0, lpOverlapped=0x0) returned 1 [0198.371] CloseHandle (hObject=0x248) returned 1 [0198.373] GetCurrentProcess () returned 0xffffffff [0198.373] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x248) returned 1 [0198.374] GetCurrentProcess () returned 0xffffffff [0198.374] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x24c) returned 1 [0198.374] GetCurrentProcess () returned 0xffffffff [0198.374] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e328 | out: TokenHandle=0x19e328*=0x250) returned 1 [0198.375] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x611edffd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x611edffd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x611edffd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6c6)) returned 1 [0198.375] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", nBufferLength=0x105, lpBuffer=0x19ddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", lpFilePart=0x0) returned 0x40 [0198.375] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x611edffd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x611edffd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x611edffd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6c6)) returned 1 [0198.375] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", nBufferLength=0x105, lpBuffer=0x19dd60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", lpFilePart=0x0) returned 0x40 [0198.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e254) returned 1 [0198.376] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x254 [0198.376] GetFileType (hFile=0x254) returned 0x1 [0198.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e250) returned 1 [0198.376] GetFileType (hFile=0x254) returned 0x1 [0198.376] GetFileSize (in: hFile=0x254, lpFileSizeHigh=0x19e31c | out: lpFileSizeHigh=0x19e31c*=0x0) returned 0x6c6 [0198.377] ReadFile (in: hFile=0x254, lpBuffer=0x2291ae0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e2d8, lpOverlapped=0x0 | out: lpBuffer=0x2291ae0*, lpNumberOfBytesRead=0x19e2d8*=0x6c6, lpOverlapped=0x0) returned 1 [0198.379] ReadFile (in: hFile=0x254, lpBuffer=0x2291ae0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e19c, lpOverlapped=0x0 | out: lpBuffer=0x2291ae0*, lpNumberOfBytesRead=0x19e19c*=0x0, lpOverlapped=0x0) returned 1 [0198.379] CloseHandle (hObject=0x254) returned 1 [0198.380] GetCurrentProcess () returned 0xffffffff [0198.380] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x254) returned 1 [0198.381] GetCurrentProcess () returned 0xffffffff [0198.381] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x258) returned 1 [0198.400] GetCurrentProcess () returned 0xffffffff [0198.400] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e214 | out: TokenHandle=0x19e214*=0x25c) returned 1 [0198.442] GetCurrentProcess () returned 0xffffffff [0198.442] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e228 | out: TokenHandle=0x19e228*=0x260) returned 1 [0198.473] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x19def0 | out: phkResult=0x19def0*=0x0) returned 0x2 [0198.481] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f408 | out: phkResult=0x19f408*=0x264) returned 0x0 [0198.481] RegQueryValueExW (in: hKey=0x264, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x19f424, lpData=0x0, lpcbData=0x19f420*=0x0 | out: lpType=0x19f424*=0x0, lpData=0x0, lpcbData=0x19f420*=0x0) returned 0x2 [0198.481] RegCloseKey (hKey=0x264) returned 0x0 [0198.576] GetCurrentProcessId () returned 0x12b0 [0198.579] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19ed74 | out: lpLuid=0x19ed74*(LowPart=0x14, HighPart=0)) returned 1 [0198.582] GetCurrentProcess () returned 0xffffffff [0198.583] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19ed70 | out: TokenHandle=0x19ed70*=0x274) returned 1 [0198.583] AdjustTokenPrivileges (in: TokenHandle=0x274, DisableAllPrivileges=0, NewState=0x22983fc*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0198.584] CloseHandle (hObject=0x274) returned 1 [0198.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x32794b0, Length=0x20000, ResultLength=0x19f454 | out: SystemInformation=0x32794b0, ResultLength=0x19f454*=0x16ee0) returned 0x0 [0198.649] GetCurrentProcessId () returned 0x12b0 [0198.655] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x32794b0, Length=0x20000, ResultLength=0x19f444 | out: SystemInformation=0x32794b0, ResultLength=0x19f444*=0x16ee0) returned 0x0 [0204.664] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ee2c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0204.664] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ee94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0204.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f2f4) returned 1 [0204.665] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19f370 | out: lpFileInformation=0x19f370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0204.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f2f0) returned 1 [0204.776] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19f07c | out: pfEnabled=0x19f07c) returned 0x0 [0204.878] CreateBindCtx (in: reserved=0x0, ppbc=0x19f420 | out: ppbc=0x19f420*=0x81fb48) returned 0x0 [0204.879] IUnknown:QueryInterface (in: This=0x81fb48, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eedc | out: ppvObject=0x19eedc*=0x81fb48) returned 0x0 [0204.884] IUnknown:QueryInterface (in: This=0x81fb48, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee98 | out: ppvObject=0x19ee98*=0x0) returned 0x80004002 [0204.884] IUnknown:QueryInterface (in: This=0x81fb48, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ecb4 | out: ppvObject=0x19ecb4*=0x0) returned 0x80004002 [0204.884] IUnknown:QueryInterface (in: This=0x81fb48, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea8c | out: ppvObject=0x19ea8c*=0x0) returned 0x80004002 [0204.885] IUnknown:AddRef (This=0x81fb48) returned 0x3 [0204.885] IUnknown:QueryInterface (in: This=0x81fb48, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7f4 | out: ppvObject=0x19e7f4*=0x0) returned 0x80004002 [0204.885] IUnknown:QueryInterface (in: This=0x81fb48, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e7a4 | out: ppvObject=0x19e7a4*=0x0) returned 0x80004002 [0204.885] IUnknown:QueryInterface (in: This=0x81fb48, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7b0 | out: ppvObject=0x19e7b0*=0x0) returned 0x80004002 [0204.885] CoGetContextToken (in: pToken=0x19e810 | out: pToken=0x19e810) returned 0x0 [0204.885] CObjectContext::QueryInterface () returned 0x0 [0204.885] CObjectContext::GetCurrentApartmentType () returned 0x0 [0204.885] Release () returned 0x0 [0204.885] CoGetObjectContext (in: riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x838794 | out: ppv=0x838794*=0x810080) returned 0x0 [0204.912] CoGetContextToken (in: pToken=0x19ec18 | out: pToken=0x19ec18) returned 0x0 [0204.912] IUnknown:QueryInterface (in: This=0x81fb48, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eca8 | out: ppvObject=0x19eca8*=0x0) returned 0x80004002 [0204.912] IUnknown:Release (This=0x81fb48) returned 0x2 [0204.912] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0 [0204.914] CoGetContextToken (in: pToken=0x19f150 | out: pToken=0x19f150) returned 0x0 [0204.914] IUnknown:QueryInterface (in: This=0x81fb48, riid=0x19f220*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f21c | out: ppvObject=0x19f21c*=0x81fb48) returned 0x0 [0204.914] IUnknown:AddRef (This=0x81fb48) returned 0x4 [0204.914] IUnknown:Release (This=0x81fb48) returned 0x3 [0204.914] IUnknown:Release (This=0x81fb48) returned 0x2 [0204.915] CoGetContextToken (in: pToken=0x19f268 | out: pToken=0x19f268) returned 0x0 [0204.915] IUnknown:AddRef (This=0x81fb48) returned 0x3 [0204.915] MkParseDisplayName (in: pbc=0x81fb48, szUserName="WinMgmts:", pchEaten=0x19f454, ppmk=0x19f40c | out: pchEaten=0x19f454, ppmk=0x19f40c*=0x85d7f0) returned 0x0 [0206.355] malloc (_Size=0x80) returned 0xa830a0 [0206.441] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x838970 [0206.441] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0206.442] DllGetClassObject (in: rclsid=0x8674cc*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x75c07590*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1f8 | out: ppv=0x19f1f8*=0x8388f8) returned 0x0 [0206.442] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x8388f8 [0206.443] WinMGMTS:IClassFactory:CreateInstance (in: This=0x8388f8, pUnkOuter=0x0, riid=0x753d6800*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1a0 | out: ppvObject=0x19f1a0*=0x83c2b0) returned 0x0 [0206.444] GetVersionExW (in: lpVersionInformation=0x19ef58*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x19efb8, dwMinorVersion=0x7459234f, dwBuildNumber=0xc0150008, dwPlatformId=0x0, szCSDVersion="\쯟≵) | out: lpVersionInformation=0x19ef58*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0206.444] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x19ef50 | out: phkResult=0x19ef50*=0x368) returned 0x0 [0206.444] RegQueryValueExW (in: hKey=0x368, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x19ef48, lpcbData=0x19ef54*=0x4 | out: lpType=0x0, lpData=0x19ef48*=0x3, lpcbData=0x19ef54*=0x4) returned 0x0 [0206.444] RegCloseKey (hKey=0x368) returned 0x0 [0206.444] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x8682c8 [0206.444] GetSystemDirectoryW (in: lpBuffer=0x8682c8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0206.444] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x74810000 [0206.445] GetProcAddress (hModule=0x74810000, lpProcName="DuplicateTokenEx") returned 0x74830ad0 [0206.445] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0206.445] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x85d750 [0206.445] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x83c2b0 [0206.445] WinMGMTS:IUnknown:Release (This=0x8388f8) returned 0x0 [0206.445] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0206.446] WinMGMTS:IParseDisplayName:ParseDisplayName (in: This=0x83c2b0, pbc=0x81fb48, pszDisplayName="WinMgmts:", pchEaten=0x19f3b0, ppmkOut=0x19f3ac | out: pchEaten=0x19f3b0*=0x9, ppmkOut=0x19f3ac*=0x85d7f0) returned 0x0 [0206.446] ApiSetQueryApiSetPresence () returned 0x0 [0206.446] _wcsnicmp (_String1="WinMgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0206.446] IBindCtx:GetObjectParam (in: This=0x81fb48, pszKey=0x6c883e5c, ppunk=0x19f258 | out: ppunk=0x19f258*=0x0) returned 0x80004005 [0206.446] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x8659b0 [0206.446] _wcsnicmp (_String1="", _String2="{", _MaxCount=0x1) returned -123 [0206.446] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x8262b8 [0206.446] ResolveDelayLoadedAPI () returned 0x75c70060 [0206.447] CoCreateInstance (in: rclsid=0x6c881c58*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c881c48*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x8262d0 | out: ppv=0x8262d0*=0x83c2f0) returned 0x0 [0206.647] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x825e40 [0206.647] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x821d50 [0206.647] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x865a50 [0206.647] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0206.647] GetCurrentThreadId () returned 0x2fc [0206.647] _wcsnicmp (_String1="", _String2="[", _MaxCount=0x1) returned -91 [0206.647] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0206.648] GetCurrentThreadId () returned 0x2fc [0206.649] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x19f0cc | out: phkResult=0x19f0cc*=0x370) returned 0x0 [0206.649] RegQueryValueExW (in: hKey=0x370, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x19f0d0*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x19f0d0*=0x16) returned 0x0 [0206.649] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x865b70 [0206.649] RegQueryValueExW (in: hKey=0x370, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x865b70, lpcbData=0x19f0d0*=0x16 | out: lpType=0x0, lpData=0x865b70*=0x72, lpcbData=0x19f0d0*=0x16) returned 0x0 [0206.650] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x865b90 [0206.651] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0206.651] RegCloseKey (hKey=0x370) returned 0x0 [0206.652] CoCreateInstance (in: rclsid=0x6c8821a8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c8821b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f104 | out: ppv=0x19f104*=0x82cea8) returned 0x0 [0206.862] SysStringLen (param_1=".") returned 0x1 [0206.862] WbemDefPath:IWbemPath:SetServer (This=0x82cea8, Name=".") returned 0x0 [0206.862] CoCreateInstance (in: rclsid=0x6c8821a8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c8821b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f0b0 | out: ppv=0x19f0b0*=0x8201a0) returned 0x0 [0206.863] CoCreateInstance (in: rclsid=0x6c8821a8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c8821b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f04c | out: ppv=0x19f04c*=0x825c08) returned 0x0 [0206.863] WbemDefPath:IWbemPath:SetText (This=0x825c08, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0206.863] WbemDefPath:IUnknown:Release (This=0x825c08) returned 0x0 [0206.863] SysStringLen (param_1="root\\cimv2") returned 0xa [0206.863] WbemDefPath:IWbemPath:SetText (This=0x8201a0, uMode=0xc, pszPath="root\\cimv2") returned 0x0 [0206.863] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8201a0, puCount=0x19f0c8 | out: puCount=0x19f0c8*=0x2) returned 0x0 [0206.863] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x82cea8) returned 0x0 [0206.863] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x8201a0, uIndex=0x0, puNameBufLength=0x19f084*=0x0, pName=0x0 | out: puNameBufLength=0x19f084*=0x5, pName=0x0) returned 0x0 [0206.863] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x8686a0 [0206.863] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x8201a0, uIndex=0x0, puNameBufLength=0x19f084*=0x5, pName="" | out: puNameBufLength=0x19f084*=0x5, pName="root") returned 0x0 [0206.863] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0206.863] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x82cea8, uIndex=0x0, pszName="root") returned 0x0 [0206.864] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x8201a0, uIndex=0x1, puNameBufLength=0x19f084*=0x0, pName=0x0 | out: puNameBufLength=0x19f084*=0x6, pName=0x0) returned 0x0 [0206.864] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x868448 [0206.864] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x8201a0, uIndex=0x1, puNameBufLength=0x19f084*=0x6, pName="" | out: puNameBufLength=0x19f084*=0x6, pName="cimv2") returned 0x0 [0206.864] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0206.864] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x82cea8, uIndex=0x1, pszName="cimv2") returned 0x0 [0206.864] WbemDefPath:IUnknown:Release (This=0x8201a0) returned 0x0 [0206.864] WbemDefPath:IWbemPath:GetText (in: This=0x82cea8, lFlags=4, puBuffLength=0x19f0cc*=0x0, pszText=0x0 | out: puBuffLength=0x19f0cc*=0xf, pszText=0x0) returned 0x0 [0206.864] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x85d9a8 [0206.864] WbemDefPath:IWbemPath:GetText (in: This=0x82cea8, lFlags=4, puBuffLength=0x19f0cc*=0xf, pszText="cimv2" | out: puBuffLength=0x19f0cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0206.864] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0206.864] WbemDefPath:IUnknown:Release (This=0x82cea8) returned 0x0 [0206.864] WbemLocator:IWbemLocator:ConnectServer (in: This=0x83c2f0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x19f14c | out: ppNamespace=0x19f14c*=0x822780) returned 0x0 [0210.485] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x825c08 [0210.485] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x822050 [0210.486] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x86ad20 [0210.486] WbemLocator:IUnknown:QueryInterface (in: This=0x822780, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f13c | out: ppvObject=0x19f13c*=0x834f1c) returned 0x0 [0210.487] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x834f1c, pProxy=0x822780, pAuthnSvc=0x19f118, pAuthzSvc=0x19f11c, pServerPrincName=0x0, pAuthnLevel=0x19f18c, pImpLevel=0x19f194, pAuthInfo=0x0, pCapabilites=0x19f120 | out: pAuthnSvc=0x19f118*=0xa, pAuthzSvc=0x19f11c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f18c*=0x6, pImpLevel=0x19f194*=0x2, pAuthInfo=0x0, pCapabilites=0x19f120*=0x1) returned 0x0 [0210.487] WbemLocator:IUnknown:Release (This=0x834f1c) returned 0x1 [0210.487] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0210.487] GetCurrentThreadId () returned 0x2fc [0210.487] WbemLocator:IUnknown:QueryInterface (in: This=0x822780, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1b4 | out: ppvObject=0x19f1b4*=0x834f1c) returned 0x0 [0210.487] WbemLocator:IClientSecurity:CopyProxy (in: This=0x834f1c, pProxy=0x822780, ppCopy=0x19f1d8 | out: ppCopy=0x19f1d8*=0x8228c0) returned 0x0 [0210.487] WbemLocator:IUnknown:QueryInterface (in: This=0x8228c0, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f050 | out: ppvObject=0x19f050*=0x834f1c) returned 0x0 [0210.488] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x834f1c, pProxy=0x8228c0, pAuthnSvc=0x19f080, pAuthzSvc=0x19f07c, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19f080*=0xa, pAuthzSvc=0x19f07c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0210.488] WbemLocator:IUnknown:Release (This=0x834f1c) returned 0x3 [0210.488] WbemLocator:IUnknown:QueryInterface (in: This=0x8228c0, riid=0x6c881f08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f034 | out: ppvObject=0x19f034*=0x834f40) returned 0x0 [0210.488] WbemLocator:IUnknown:QueryInterface (in: This=0x8228c0, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f038 | out: ppvObject=0x19f038*=0x834f1c) returned 0x0 [0210.488] WbemLocator:IClientSecurity:SetBlanket (This=0x834f1c, pProxy=0x8228c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0210.488] WbemLocator:IUnknown:Release (This=0x834f1c) returned 0x4 [0210.489] WbemLocator:IUnknown:Release (This=0x834f40) returned 0x3 [0210.489] WbemLocator:IUnknown:Release (This=0x834f1c) returned 0x2 [0210.489] WbemLocator:IUnknown:AddRef (This=0x8228c0) returned 0x3 [0210.489] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x822110 [0210.489] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x8658b0 [0210.489] WbemLocator:IUnknown:Release (This=0x822780) returned 0x2 [0210.489] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0210.489] GetCurrentThreadId () returned 0x2fc [0210.489] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0210.489] GetCurrentThreadId () returned 0x2fc [0210.489] WbemLocator:IUnknown:QueryInterface (in: This=0x8228c0, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1dc | out: ppvObject=0x19f1dc*=0x834f1c) returned 0x0 [0210.490] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x834f1c, pProxy=0x8228c0, pAuthnSvc=0x19f1c8, pAuthzSvc=0x19f1cc, pServerPrincName=0x0, pAuthnLevel=0x19f1d8, pImpLevel=0x19f1d4, pAuthInfo=0x0, pCapabilites=0x19f1d0 | out: pAuthnSvc=0x19f1c8*=0xa, pAuthzSvc=0x19f1cc*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f1d8*=0x6, pImpLevel=0x19f1d4*=0x3, pAuthInfo=0x0, pCapabilites=0x19f1d0*=0x20) returned 0x0 [0210.490] WbemLocator:IUnknown:Release (This=0x834f1c) returned 0x2 [0210.490] ResolveDelayLoadedAPI () returned 0x75402060 [0210.494] CreatePointerMoniker (in: punk=0x825c08, ppmk=0x19f3ac | out: ppmk=0x19f3ac*=0x85d7f0) returned 0x0 [0210.494] IUnknown:AddRef (This=0x825c08) returned 0x2 [0210.502] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0210.502] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0210.502] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0210.502] WbemLocator:IUnknown:Release (This=0x83c2f0) returned 0x0 [0210.502] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0210.502] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0210.504] WinMGMTS:IUnknown:Release (This=0x83c2b0) returned 0x0 [0210.504] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0210.509] IUnknown:QueryInterface (in: This=0x85d7f0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eed0 | out: ppvObject=0x19eed0*=0x85d7f0) returned 0x0 [0210.510] IUnknown:QueryInterface (in: This=0x85d7f0, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee8c | out: ppvObject=0x19ee8c*=0x0) returned 0x80004002 [0210.510] IUnknown:QueryInterface (in: This=0x85d7f0, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ecac | out: ppvObject=0x19ecac*=0x0) returned 0x80004002 [0210.510] IUnknown:QueryInterface (in: This=0x85d7f0, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea84 | out: ppvObject=0x19ea84*=0x0) returned 0x80004002 [0210.510] IUnknown:AddRef (This=0x85d7f0) returned 0x3 [0210.511] IUnknown:QueryInterface (in: This=0x85d7f0, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ec | out: ppvObject=0x19e7ec*=0x0) returned 0x80004002 [0210.511] IUnknown:QueryInterface (in: This=0x85d7f0, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e79c | out: ppvObject=0x19e79c*=0x0) returned 0x80004002 [0210.511] IUnknown:QueryInterface (in: This=0x85d7f0, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7a8 | out: ppvObject=0x19e7a8*=0x85d804) returned 0x0 [0210.511] IMarshal:GetUnmarshalClass (in: This=0x85d804, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e7b0 | out: pCid=0x19e7b0*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0210.511] IUnknown:Release (This=0x85d804) returned 0x3 [0210.511] CoGetContextToken (in: pToken=0x19e808 | out: pToken=0x19e808) returned 0x0 [0210.511] CoGetContextToken (in: pToken=0x19ec10 | out: pToken=0x19ec10) returned 0x0 [0210.511] IUnknown:QueryInterface (in: This=0x85d7f0, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eca0 | out: ppvObject=0x19eca0*=0x0) returned 0x80004002 [0210.512] IUnknown:Release (This=0x85d7f0) returned 0x2 [0210.512] CoGetContextToken (in: pToken=0x19f1e0 | out: pToken=0x19f1e0) returned 0x0 [0210.512] CoGetContextToken (in: pToken=0x19f140 | out: pToken=0x19f140) returned 0x0 [0210.512] IUnknown:QueryInterface (in: This=0x85d7f0, riid=0x19f210*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f20c | out: ppvObject=0x19f20c*=0x85d7f0) returned 0x0 [0210.512] IUnknown:AddRef (This=0x85d7f0) returned 0x4 [0210.512] IUnknown:Release (This=0x85d7f0) returned 0x3 [0210.512] IUnknown:Release (This=0x81fb48) returned 0x2 [0210.512] IUnknown:Release (This=0x85d7f0) returned 0x2 [0210.516] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0210.516] IUnknown:AddRef (This=0x85d7f0) returned 0x3 [0210.516] BindMoniker (in: pmk=0x85d7f0, grfOpt=0x0, iidResult=0x2310ae8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x19f410 | out: ppvResult=0x19f410*=0x825c08) returned 0x0 [0210.516] IUnknown:QueryInterface (in: This=0x825c08, riid=0x2310ae8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f410 | out: ppvObject=0x19f410*=0x825c08) returned 0x0 [0210.516] LoadRegTypeLib (in: rguid=0x6c882198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x19ec6c*=0x0 | out: pptlib=0x19ec6c*=0x872618) returned 0x0 [0210.796] ITypeLib:GetTypeInfoOfGuid (in: This=0x872618, GUID=0x825c4c*(Data1=0x62e522dc, Data2=0x8cf3, Data3=0x40a8, Data4=([0]=0x8b, [1]=0x2e, [2]=0x37, [3]=0xd5, [4]=0x95, [5]=0x65, [6]=0x1e, [7]=0x40)), ppTInfo=0x825c34 | out: ppTInfo=0x825c34*=0x87406c) returned 0x0 [0210.801] IUnknown:Release (This=0x872618) returned 0x1 [0210.835] CoGetContextToken (in: pToken=0x19e808 | out: pToken=0x19e808) returned 0x0 [0210.835] CoGetContextToken (in: pToken=0x19ec10 | out: pToken=0x19ec10) returned 0x0 [0210.835] IUnknown:Release (This=0x85d7f0) returned 0x2 [0211.045] CoGetContextToken (in: pToken=0x19eef0 | out: pToken=0x19eef0) returned 0x0 [0211.045] LoadRegTypeLib (in: rguid=0x6c882198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x19eed8*=0x0 | out: pptlib=0x19eed8*=0x872618) returned 0x0 [0211.046] ITypeLib:GetTypeInfoOfGuid (in: This=0x872618, GUID=0x825c3c*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x825c30 | out: ppTInfo=0x825c30*=0x874098) returned 0x0 [0211.047] IUnknown:Release (This=0x872618) returned 0x2 [0211.047] IUnknown:AddRef (This=0x874098) returned 0x2 [0211.047] DispGetIDsOfNames (in: ptinfo=0x874098, rgszNames=0x19ef60*="InstancesOf", cNames=0x1, rgdispid=0x19ef50 | out: rgdispid=0x19ef50*=5) returned 0x0 [0211.050] IUnknown:Release (This=0x874098) returned 0x1 [0211.052] IUnknown:AddRef (This=0x874098) returned 0x2 [0211.052] ITypeInfo:LocalInvoke (This=0x874098) returned 0x0 [0211.057] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0211.057] GetCurrentThreadId () returned 0x2fc [0211.057] WbemLocator:IUnknown:AddRef (This=0x8228c0) returned 0x3 [0211.057] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0211.057] GetCurrentThreadId () returned 0x2fc [0211.058] IWbemServices:CreateInstanceEnum (in: This=0x8228c0, strFilter="Win32_BaseBoard", lFlags=16, pCtx=0x0, ppEnum=0x19e764 | out: ppEnum=0x19e764*=0x869cb0) returned 0x0 [0211.067] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x8221d0 [0211.067] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x821e70 [0211.067] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x821c30 [0211.067] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x865a50 [0211.067] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x86add8 [0211.067] IUnknown:QueryInterface (in: This=0x869cb0, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x869cb4) returned 0x0 [0211.067] IClientSecurity:QueryBlanket (in: This=0x869cb4, pProxy=0x869cb0, pAuthnSvc=0x19e5f8, pAuthzSvc=0x19e600, pServerPrincName=0x0, pAuthnLevel=0x19e634, pImpLevel=0x19e638, pAuthInfo=0x0, pCapabilites=0x19e5fc | out: pAuthnSvc=0x19e5f8*=0xa, pAuthzSvc=0x19e600*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e634*=0x6, pImpLevel=0x19e638*=0x2, pAuthInfo=0x0, pCapabilites=0x19e5fc*=0x1) returned 0x0 [0211.067] IUnknown:Release (This=0x869cb4) returned 0x1 [0211.067] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0211.067] GetCurrentThreadId () returned 0x2fc [0211.067] WbemLocator:IUnknown:QueryInterface (in: This=0x8228c0, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5fc | out: ppvObject=0x19e5fc*=0x834f1c) returned 0x0 [0211.068] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x834f1c, pProxy=0x8228c0, pAuthnSvc=0x19e5e4, pAuthzSvc=0x19e5e8, pServerPrincName=0x0, pAuthnLevel=0x19e5f4, pImpLevel=0x19e5f8, pAuthInfo=0x0, pCapabilites=0x19e5ec | out: pAuthnSvc=0x19e5e4*=0xa, pAuthzSvc=0x19e5e8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e5f4*=0x6, pImpLevel=0x19e5f8*=0x3, pAuthInfo=0x0, pCapabilites=0x19e5ec*=0x20) returned 0x0 [0211.068] WbemLocator:IUnknown:Release (This=0x834f1c) returned 0x3 [0211.068] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0211.068] GetCurrentThreadId () returned 0x2fc [0211.068] WbemLocator:IUnknown:QueryInterface (in: This=0x8228c0, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5fc | out: ppvObject=0x19e5fc*=0x834f1c) returned 0x0 [0211.068] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x834f1c, pProxy=0x8228c0, pAuthnSvc=0x19e5e4, pAuthzSvc=0x19e5e8, pServerPrincName=0x0, pAuthnLevel=0x19e5f8, pImpLevel=0x19e5f4, pAuthInfo=0x0, pCapabilites=0x19e5ec | out: pAuthnSvc=0x19e5e4*=0xa, pAuthzSvc=0x19e5e8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e5f8*=0x6, pImpLevel=0x19e5f4*=0x3, pAuthInfo=0x0, pCapabilites=0x19e5ec*=0x20) returned 0x0 [0211.068] WbemLocator:IUnknown:Release (This=0x834f1c) returned 0x3 [0211.068] IUnknown:QueryInterface (in: This=0x869cb0, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e62c | out: ppvObject=0x19e62c*=0x869cb4) returned 0x0 [0211.070] IClientSecurity:CopyProxy (in: This=0x869cb4, pProxy=0x869cb0, ppCopy=0x19e630 | out: ppCopy=0x19e630*=0x874d60) returned 0x0 [0211.082] IUnknown:QueryInterface (in: This=0x874d60, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e584 | out: ppvObject=0x19e584*=0x874d64) returned 0x0 [0211.083] IClientSecurity:QueryBlanket (in: This=0x874d64, pProxy=0x874d60, pAuthnSvc=0x19e5b4, pAuthzSvc=0x19e5b0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19e5b4*=0xa, pAuthzSvc=0x19e5b0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0211.083] IUnknown:Release (This=0x874d64) returned 0x3 [0211.083] IUnknown:QueryInterface (in: This=0x874d60, riid=0x6c881f08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e568 | out: ppvObject=0x19e568*=0x836040) returned 0x0 [0211.083] IUnknown:QueryInterface (in: This=0x874d60, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e56c | out: ppvObject=0x19e56c*=0x874d64) returned 0x0 [0211.083] IClientSecurity:SetBlanket (This=0x874d64, pProxy=0x874d60, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0211.287] IUnknown:Release (This=0x874d64) returned 0x4 [0211.287] WbemLocator:IUnknown:Release (This=0x836040) returned 0x3 [0211.287] IUnknown:Release (This=0x869cb4) returned 0x2 [0211.287] IUnknown:AddRef (This=0x874d60) returned 0x3 [0211.287] IUnknown:Release (This=0x869cb0) returned 0x2 [0211.287] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19e720 | out: pperrinfo=0x19e720*=0x0) returned 0x1 [0211.287] WbemLocator:IUnknown:Release (This=0x8228c0) returned 0x2 [0211.287] IUnknown:Release (This=0x874098) returned 0x1 [0211.288] LoadRegTypeLib (in: rguid=0x6c882198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x19e734*=0x0 | out: pptlib=0x19e734*=0x872618) returned 0x0 [0211.288] ITypeLib:GetTypeInfoOfGuid (in: This=0x872618, GUID=0x822208*(Data1=0x4b83d61, Data2=0x21ae, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x33, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x8221f0 | out: ppTInfo=0x8221f0*=0x8741a0) returned 0x0 [0211.289] IUnknown:Release (This=0x872618) returned 0x3 [0211.289] IUnknown:AddRef (This=0x8741a0) returned 0x2 [0211.289] ITypeInfo:RemoteGetTypeAttr (in: This=0x8741a0, ppTypeAttr=0x19e770, pDummy=0xcc29a9d7 | out: ppTypeAttr=0x19e770, pDummy=0xcc29a9d7) returned 0x0 [0211.290] ITypeInfo:LocalReleaseTypeAttr (This=0x8741a0) returned 0x0 [0211.290] IUnknown:Release (This=0x8741a0) returned 0x1 [0211.290] CoGetContextToken (in: pToken=0x19e2d0 | out: pToken=0x19e2d0) returned 0x0 [0211.290] CoGetContextToken (in: pToken=0x19e6d8 | out: pToken=0x19e6d8) returned 0x0 [0211.292] CoGetContextToken (in: pToken=0x19f2b0 | out: pToken=0x19f2b0) returned 0x0 [0211.292] CoGetContextToken (in: pToken=0x19f210 | out: pToken=0x19f210) returned 0x0 [0211.293] CoGetContextToken (in: pToken=0x19f230 | out: pToken=0x19f230) returned 0x0 [0211.293] LoadRegTypeLib (in: rguid=0x6c882198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x19f220*=0x0 | out: pptlib=0x19f220*=0x872618) returned 0x0 [0211.295] ITypeLib:GetTypeInfoOfGuid (in: This=0x872618, GUID=0x8221f8*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x8221ec | out: ppTInfo=0x8221ec*=0x874148) returned 0x0 [0211.295] IUnknown:Release (This=0x872618) returned 0x4 [0211.295] IUnknown:AddRef (This=0x874148) returned 0x2 [0211.295] ITypeInfo:LocalInvoke (This=0x874148) returned 0x0 [0211.295] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0211.295] GetCurrentThreadId () returned 0x2fc [0211.295] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x8684c0 [0211.295] IUnknown:Release (This=0x874148) returned 0x1 [0211.295] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0211.838] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x818af0 [0211.851] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x819040 [0212.109] CoGetContextToken (in: pToken=0x19ef60 | out: pToken=0x19ef60) returned 0x0 [0212.150] CoGetContextToken (in: pToken=0x19ea60 | out: pToken=0x19ea60) returned 0x0 [0212.150] IUnknown:AddRef (This=0x874148) returned 0x2 [0212.150] ITypeInfo:LocalInvoke (This=0x874148) returned 0x0 [0212.151] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0212.151] GetCurrentThreadId () returned 0x2fc [0212.151] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0212.151] GetCurrentThreadId () returned 0x2fc [0212.151] IUnknown:AddRef (This=0x874d60) returned 0x3 [0212.151] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0212.151] GetCurrentThreadId () returned 0x2fc [0212.151] IEnumWbemClassObject:Clone (in: This=0x874d60, ppEnum=0x19ea90 | out: ppEnum=0x19ea90*=0x878518) returned 0x0 [0212.153] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x87b098 [0212.153] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x87b2d8 [0212.153] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x87b0f8 [0212.153] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x865810 [0212.153] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x86ae90 [0212.153] IUnknown:QueryInterface (in: This=0x878518, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e93c | out: ppvObject=0x19e93c*=0x87851c) returned 0x0 [0212.153] IClientSecurity:QueryBlanket (in: This=0x87851c, pProxy=0x878518, pAuthnSvc=0x19e928, pAuthzSvc=0x19e930, pServerPrincName=0x0, pAuthnLevel=0x19e964, pImpLevel=0x19e968, pAuthInfo=0x0, pCapabilites=0x19e92c | out: pAuthnSvc=0x19e928*=0xa, pAuthzSvc=0x19e930*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e964*=0x6, pImpLevel=0x19e968*=0x2, pAuthInfo=0x0, pCapabilites=0x19e92c*=0x1) returned 0x0 [0212.153] IUnknown:Release (This=0x87851c) returned 0x1 [0212.153] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0212.153] GetCurrentThreadId () returned 0x2fc [0212.153] IUnknown:QueryInterface (in: This=0x874d60, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e92c | out: ppvObject=0x19e92c*=0x874d64) returned 0x0 [0212.154] IClientSecurity:QueryBlanket (in: This=0x874d64, pProxy=0x874d60, pAuthnSvc=0x19e914, pAuthzSvc=0x19e918, pServerPrincName=0x0, pAuthnLevel=0x19e924, pImpLevel=0x19e928, pAuthInfo=0x0, pCapabilites=0x19e91c | out: pAuthnSvc=0x19e914*=0xa, pAuthzSvc=0x19e918*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e924*=0x6, pImpLevel=0x19e928*=0x3, pAuthInfo=0x0, pCapabilites=0x19e91c*=0x20) returned 0x0 [0212.154] IUnknown:Release (This=0x874d64) returned 0x3 [0212.154] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0212.154] GetCurrentThreadId () returned 0x2fc [0212.154] IUnknown:QueryInterface (in: This=0x874d60, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e92c | out: ppvObject=0x19e92c*=0x874d64) returned 0x0 [0212.154] IClientSecurity:QueryBlanket (in: This=0x874d64, pProxy=0x874d60, pAuthnSvc=0x19e914, pAuthzSvc=0x19e918, pServerPrincName=0x0, pAuthnLevel=0x19e928, pImpLevel=0x19e924, pAuthInfo=0x0, pCapabilites=0x19e91c | out: pAuthnSvc=0x19e914*=0xa, pAuthzSvc=0x19e918*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e928*=0x6, pImpLevel=0x19e924*=0x3, pAuthInfo=0x0, pCapabilites=0x19e91c*=0x20) returned 0x0 [0212.154] IUnknown:Release (This=0x874d64) returned 0x3 [0212.154] IUnknown:QueryInterface (in: This=0x878518, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e95c | out: ppvObject=0x19e95c*=0x87851c) returned 0x0 [0212.154] IClientSecurity:CopyProxy (in: This=0x87851c, pProxy=0x878518, ppCopy=0x19e960 | out: ppCopy=0x19e960*=0x87e640) returned 0x0 [0212.154] IUnknown:QueryInterface (in: This=0x87e640, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e8b4 | out: ppvObject=0x19e8b4*=0x87e644) returned 0x0 [0212.154] IClientSecurity:QueryBlanket (in: This=0x87e644, pProxy=0x87e640, pAuthnSvc=0x19e8e4, pAuthzSvc=0x19e8e0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19e8e4*=0xa, pAuthzSvc=0x19e8e0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0212.154] IUnknown:Release (This=0x87e644) returned 0x3 [0212.154] IUnknown:QueryInterface (in: This=0x87e640, riid=0x6c881f08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e898 | out: ppvObject=0x19e898*=0x834840) returned 0x0 [0212.154] IUnknown:QueryInterface (in: This=0x87e640, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e89c | out: ppvObject=0x19e89c*=0x87e644) returned 0x0 [0212.154] IClientSecurity:SetBlanket (This=0x87e644, pProxy=0x87e640, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0212.156] IUnknown:Release (This=0x87e644) returned 0x4 [0212.156] WbemLocator:IUnknown:Release (This=0x834840) returned 0x3 [0212.156] IUnknown:Release (This=0x87851c) returned 0x2 [0212.157] IUnknown:AddRef (This=0x87e640) returned 0x3 [0212.157] IUnknown:Release (This=0x878518) returned 0x2 [0212.157] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19ea50 | out: pperrinfo=0x19ea50*=0x0) returned 0x1 [0212.157] IUnknown:Release (This=0x874d60) returned 0x2 [0212.157] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0212.157] GetCurrentThreadId () returned 0x2fc [0212.157] IUnknown:AddRef (This=0x87e640) returned 0x3 [0212.157] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0212.157] GetCurrentThreadId () returned 0x2fc [0212.157] IEnumWbemClassObject:Reset (This=0x87e640) returned 0x0 [0212.158] IUnknown:Release (This=0x87e640) returned 0x2 [0212.158] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x868718 [0212.158] IUnknown:Release (This=0x874148) returned 0x1 [0212.184] CoGetContextToken (in: pToken=0x19e248 | out: pToken=0x19e248) returned 0x0 [0212.184] CoGetContextToken (in: pToken=0x19e650 | out: pToken=0x19e650) returned 0x0 [0212.214] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0212.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0212.214] GetCurrentThreadId () returned 0x2fc [0212.214] IUnknown:AddRef (This=0x87e640) returned 0x3 [0212.214] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0212.214] GetCurrentThreadId () returned 0x2fc [0212.214] IEnumWbemClassObject:Next (in: This=0x87e640, lTimeout=-1, uCount=0x1, apObjects=0x19f3bc, puReturned=0x19f39c | out: apObjects=0x19f3bc*=0x83ac98, puReturned=0x19f39c*=0x1) returned 0x0 [0212.256] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x86c090 [0212.256] IUnknown:AddRef (This=0x83ac98) returned 0x2 [0212.257] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x821510 [0212.257] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x87b818 [0212.257] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x87aeb8 [0212.257] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x8657d0 [0212.257] WbemLocator:IUnknown:AddRef (This=0x8228c0) returned 0x3 [0212.257] IUnknown:AddRef (This=0x87e640) returned 0x4 [0212.257] IUnknown:QueryInterface (in: This=0x87e640, riid=0x6c881f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f3e8 | out: ppvObject=0x19f3e8*=0x87e644) returned 0x0 [0212.257] IClientSecurity:QueryBlanket (in: This=0x87e644, pProxy=0x87e640, pAuthnSvc=0x19f36c, pAuthzSvc=0x19f374, pServerPrincName=0x0, pAuthnLevel=0x19f398, pImpLevel=0x19f3a4, pAuthInfo=0x0, pCapabilites=0x19f368 | out: pAuthnSvc=0x19f36c*=0xa, pAuthzSvc=0x19f374*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f398*=0x6, pImpLevel=0x19f3a4*=0x3, pAuthInfo=0x0, pCapabilites=0x19f368*=0x20) returned 0x0 [0212.257] IUnknown:Release (This=0x87e644) returned 0x4 [0212.257] WbemLocator:IUnknown:Release (This=0x8228c0) returned 0x2 [0212.257] WbemLocator:IUnknown:AddRef (This=0x8228c0) returned 0x3 [0212.257] IUnknown:Release (This=0x87e640) returned 0x3 [0212.257] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0212.257] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x86f1e0 [0212.257] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x865550 [0212.257] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x880578 [0212.257] IUnknown:AddRef (This=0x83ac98) returned 0x3 [0212.257] IUnknown:Release (This=0x83ac98) returned 0x2 [0212.257] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f334 | out: pperrinfo=0x19f334*=0x0) returned 0x1 [0212.258] IUnknown:Release (This=0x87e640) returned 0x2 [0212.258] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f3ec | out: pperrinfo=0x19f3ec*=0x0) returned 0x1 [0212.258] LoadRegTypeLib (in: rguid=0x6c882198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x19eb94*=0x0 | out: pptlib=0x19eb94*=0x872618) returned 0x0 [0212.259] ITypeLib:GetTypeInfoOfGuid (in: This=0x872618, GUID=0x6c884c08*(Data1=0xd6bdafb2, Data2=0x9435, Data3=0x491f, Data4=([0]=0xbb, [1]=0x87, [2]=0x6a, [3]=0xa0, [4]=0xf0, [5]=0xbc, [6]=0x31, [7]=0xa2)), ppTInfo=0x86f1fc | out: ppTInfo=0x86f1fc*=0x8741cc) returned 0x0 [0212.259] IUnknown:Release (This=0x872618) returned 0x5 [0212.259] IUnknown:AddRef (This=0x8741cc) returned 0x2 [0212.259] ITypeInfo:RemoteGetTypeAttr (in: This=0x8741cc, ppTypeAttr=0x19ebd0, pDummy=0xcc29a5b7 | out: ppTypeAttr=0x19ebd0, pDummy=0xcc29a5b7) returned 0x0 [0212.260] ITypeInfo:LocalReleaseTypeAttr (This=0x8741cc) returned 0x0 [0212.260] IUnknown:Release (This=0x8741cc) returned 0x1 [0212.261] CoGetContextToken (in: pToken=0x19e730 | out: pToken=0x19e730) returned 0x0 [0212.261] CoGetContextToken (in: pToken=0x19eb38 | out: pToken=0x19eb38) returned 0x0 [0212.266] CoGetContextToken (in: pToken=0x19ef00 | out: pToken=0x19ef00) returned 0x0 [0212.266] LoadRegTypeLib (in: rguid=0x6c882198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x19eee8*=0x0 | out: pptlib=0x19eee8*=0x872618) returned 0x0 [0212.268] ITypeLib:GetTypeInfoOfGuid (in: This=0x872618, GUID=0x6c881e68*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x86f1f8 | out: ppTInfo=0x86f1f8*=0x8741f8) returned 0x0 [0212.268] IUnknown:Release (This=0x872618) returned 0x6 [0212.268] IUnknown:AddRef (This=0x8741f8) returned 0x2 [0212.268] DispGetIDsOfNames (in: ptinfo=0x8741f8, rgszNames=0x19ef70*="SerialNumber", cNames=0x1, rgdispid=0x19ef60 | out: rgdispid=0x19ef60*=-1) returned 0x80020006 [0212.306] IUnknown:AddRef (This=0x83ac98) returned 0x3 [0212.306] IWbemClassObject:Get (in: This=0x83ac98, wszName="SerialNumber", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x19eeb8*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x19eeb8*=0) returned 0x0 [0212.306] IUnknown:Release (This=0x83ac98) returned 0x2 [0212.306] SysStringLen (param_1="SerialNumber") returned 0xc [0212.306] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x880550 [0212.306] SysStringLen (param_1="SerialNumber") returned 0xc [0212.306] IUnknown:Release (This=0x8741f8) returned 0x1 [0212.307] IUnknown:AddRef (This=0x8741f8) returned 0x2 [0212.307] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0212.307] GetCurrentThreadId () returned 0x2fc [0212.307] SysStringLen (param_1="SerialNumber") returned 0xc [0212.307] IWbemClassObject:Get (in: This=0x83ac98, wszName="SerialNumber", lFlags=0, pVal=0x19ed00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19ecf8*=0, plFlavor=0x0 | out: pVal=0x19ed00*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="..XXXXXXXXXXXXX.", varVal2=0x0), pType=0x19ecf8*=8, plFlavor=0x0) returned 0x0 [0212.308] IUnknown:Release (This=0x8741f8) returned 0x1 [0212.308] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0212.309] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0212.411] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0212.411] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0212.411] GetCurrentThreadId () returned 0x2fc [0212.412] IUnknown:AddRef (This=0x87e640) returned 0x3 [0212.412] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0212.412] GetCurrentThreadId () returned 0x2fc [0212.412] IEnumWbemClassObject:Next (in: This=0x87e640, lTimeout=-1, uCount=0x1, apObjects=0x19f3bc, puReturned=0x19f39c | out: apObjects=0x19f3bc*=0x0, puReturned=0x19f39c*=0x0) returned 0x1 [0212.413] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f334 | out: pperrinfo=0x19f334*=0x0) returned 0x1 [0212.413] IUnknown:Release (This=0x87e640) returned 0x2 [0212.414] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f3ec | out: pperrinfo=0x19f3ec*=0x0) returned 0x1 [0212.685] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a0 [0212.687] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3b0 [0212.701] SetEvent (hEvent=0x3b0) returned 1 [0212.746] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3c4*=0x3a0, lpdwindex=0x19f1e4 | out: lpdwindex=0x19f1e4) returned 0x0 [0212.756] CoGetContextToken (in: pToken=0x19f290 | out: pToken=0x19f290) returned 0x0 [0212.756] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0 [0212.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x82c278, riid=0x19f2c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f2bc | out: ppvObject=0x19f2bc*=0x82c278) returned 0x0 [0212.756] WbemDefPath:IUnknown:AddRef (This=0x82c278) returned 0x3 [0212.756] WbemDefPath:IUnknown:Release (This=0x82c278) returned 0x2 [0212.759] WbemDefPath:IWbemPath:SetText (This=0x82c278, uMode=0x4, pszPath="win32_processor") returned 0x0 [0212.762] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x82c278, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0 [0212.762] WbemDefPath:IWbemPath:GetText (in: This=0x82c278, lFlags=2, puBuffLength=0x19f440*=0x0, pszText=0x0 | out: puBuffLength=0x19f440*=0x10, pszText=0x0) returned 0x0 [0212.762] WbemDefPath:IWbemPath:GetText (in: This=0x82c278, lFlags=2, puBuffLength=0x19f440*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f440*=0x10, pszText="win32_processor") returned 0x0 [0212.763] WbemDefPath:IWbemPath:GetInfo (in: This=0x82c278, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0 [0212.763] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x82c278, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0 [0212.763] WbemDefPath:IWbemPath:GetInfo (in: This=0x82c278, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0 [0212.763] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x82c278, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0 [0212.763] WbemDefPath:IWbemPath:GetText (in: This=0x82c278, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x10, pszText=0x0) returned 0x0 [0212.763] WbemDefPath:IWbemPath:GetText (in: This=0x82c278, lFlags=2, puBuffLength=0x19f430*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f430*=0x10, pszText="win32_processor") returned 0x0 [0212.763] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x82c278, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0 [0212.763] WbemDefPath:IWbemPath:GetText (in: This=0x82c278, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x10, pszText=0x0) returned 0x0 [0212.763] WbemDefPath:IWbemPath:GetText (in: This=0x82c278, lFlags=2, puBuffLength=0x19f430*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f430*=0x10, pszText="win32_processor") returned 0x0 [0212.764] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x82c278, puCount=0x19f3c4 | out: puCount=0x19f3c4*=0x0) returned 0x0 [0212.764] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3d8 [0212.764] SetEvent (hEvent=0x3b0) returned 1 [0212.764] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19ec24*=0x3d8, lpdwindex=0x19ea44 | out: lpdwindex=0x19ea44) returned 0x0 [0212.768] CoGetContextToken (in: pToken=0x19eaf0 | out: pToken=0x19eaf0) returned 0x0 [0212.768] CoGetContextToken (in: pToken=0x19ea50 | out: pToken=0x19ea50) returned 0x0 [0212.768] WbemDefPath:IUnknown:QueryInterface (in: This=0x8069c8, riid=0x19eb20*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19eb1c | out: ppvObject=0x19eb1c*=0x8069c8) returned 0x0 [0212.768] WbemDefPath:IUnknown:AddRef (This=0x8069c8) returned 0x3 [0212.768] WbemDefPath:IUnknown:Release (This=0x8069c8) returned 0x2 [0212.768] WbemDefPath:IWbemPath:SetText (This=0x8069c8, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0212.768] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f3b0 | out: puCount=0x19f3b0*=0x2) returned 0x0 [0212.768] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f3ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f3ac*=0xf, pszText=0x0) returned 0x0 [0212.768] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f3ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.768] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3dc [0212.768] SetEvent (hEvent=0x3b0) returned 1 [0212.769] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f30c*=0x3dc, lpdwindex=0x19f12c | out: lpdwindex=0x19f12c) returned 0x0 [0212.771] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0212.771] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0212.771] WbemDefPath:IUnknown:QueryInterface (in: This=0x8828f0, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x8828f0) returned 0x0 [0212.771] WbemDefPath:IUnknown:AddRef (This=0x8828f0) returned 0x3 [0212.771] WbemDefPath:IUnknown:Release (This=0x8828f0) returned 0x2 [0212.771] WbemDefPath:IWbemPath:SetText (This=0x8828f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0212.771] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8828f0, puCount=0x19f388 | out: puCount=0x19f388*=0x2) returned 0x0 [0212.771] WbemDefPath:IWbemPath:GetText (in: This=0x8828f0, lFlags=4, puBuffLength=0x19f384*=0x0, pszText=0x0 | out: puBuffLength=0x19f384*=0xf, pszText=0x0) returned 0x0 [0212.771] WbemDefPath:IWbemPath:GetText (in: This=0x8828f0, lFlags=4, puBuffLength=0x19f384*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f384*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.783] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f2a8*=0x3f0, lpdwindex=0x19f15c | out: lpdwindex=0x19f15c) returned 0x0 [0215.395] CoGetContextToken (in: pToken=0x19f0a0 | out: pToken=0x19f0a0) returned 0x0 [0215.395] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0215.395] IUnknown:QueryInterface (in: This=0x810138, riid=0x6b2e8724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f028 | out: ppvObject=0x19f028*=0x810148) returned 0x0 [0215.396] CObjectContext::ContextCallback () returned 0x0 [0215.476] IUnknown:Release (This=0x810148) returned 0x1 [0215.476] CoUnmarshalInterface (in: pStm=0x865530, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f090 | out: ppv=0x19f090*=0x834940) returned 0x0 [0215.476] CoMarshalInterface (pStm=0x865530, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x834940, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0215.477] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef34 | out: ppvObject=0x19ef34*=0x834940) returned 0x0 [0215.477] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19eef0 | out: ppvObject=0x19eef0*=0x0) returned 0x80004002 [0215.478] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x0) returned 0x80004002 [0215.479] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19eae4 | out: ppvObject=0x19eae4*=0x0) returned 0x80004002 [0215.480] WbemLocator:IUnknown:AddRef (This=0x834940) returned 0x3 [0215.480] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e84c | out: ppvObject=0x19e84c*=0x0) returned 0x80004002 [0215.480] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0215.480] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e808 | out: ppvObject=0x19e808*=0x83489c) returned 0x0 [0215.480] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x83489c, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e810 | out: pCid=0x19e810*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0215.480] WbemLocator:IUnknown:Release (This=0x83489c) returned 0x3 [0215.480] CoGetContextToken (in: pToken=0x19e868 | out: pToken=0x19e868) returned 0x0 [0215.480] CoGetContextToken (in: pToken=0x19ec70 | out: pToken=0x19ec70) returned 0x0 [0215.480] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed00 | out: ppvObject=0x19ed00*=0x834924) returned 0x0 [0215.480] WbemLocator:IRpcOptions:Query (in: This=0x834924, pPrx=0x834940, dwProperty=2, pdwValue=0x19ed28 | out: pdwValue=0x19ed28) returned 0x0 [0215.481] WbemLocator:IUnknown:Release (This=0x834924) returned 0x3 [0215.481] WbemLocator:IUnknown:Release (This=0x834940) returned 0x2 [0215.481] WbemLocator:IUnknown:Release (This=0x834940) returned 0x1 [0215.481] CoGetContextToken (in: pToken=0x19efe0 | out: pToken=0x19efe0) returned 0x0 [0215.481] WbemLocator:IUnknown:AddRef (This=0x834940) returned 0x2 [0215.481] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x83491c) returned 0x0 [0215.481] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x83491c, pProxy=0x834940, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0 [0215.481] WbemLocator:IUnknown:Release (This=0x83491c) returned 0x2 [0215.481] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x834940) returned 0x0 [0215.481] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x83491c) returned 0x0 [0215.482] WbemLocator:IClientSecurity:SetBlanket (This=0x83491c, pProxy=0x834940, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0215.482] WbemLocator:IUnknown:Release (This=0x83491c) returned 0x3 [0215.482] WbemLocator:IUnknown:Release (This=0x834940) returned 0x2 [0215.482] CoTaskMemFree (pv=0x888090) [0215.482] WbemLocator:IUnknown:Release (This=0x834940) returned 0x1 [0215.482] SysStringLen (param_1=0x0) returned 0x0 [0215.482] CoGetContextToken (in: pToken=0x19f258 | out: pToken=0x19f258) returned 0x0 [0215.482] CoGetContextToken (in: pToken=0x19f1b8 | out: pToken=0x19f1b8) returned 0x0 [0215.482] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x19f288*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x804790) returned 0x0 [0215.483] WbemLocator:IUnknown:AddRef (This=0x804790) returned 0x3 [0215.483] WbemLocator:IUnknown:Release (This=0x804790) returned 0x2 [0215.483] CoGetContextToken (in: pToken=0x19f218 | out: pToken=0x19f218) returned 0x0 [0215.483] WbemLocator:IUnknown:AddRef (This=0x804790) returned 0x3 [0215.483] WbemLocator:IUnknown:QueryInterface (in: This=0x804790, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x83491c) returned 0x0 [0215.483] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x83491c, pProxy=0x804790, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0 [0215.483] WbemLocator:IUnknown:Release (This=0x83491c) returned 0x3 [0215.483] WbemLocator:IUnknown:QueryInterface (in: This=0x804790, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x834940) returned 0x0 [0215.483] WbemLocator:IUnknown:QueryInterface (in: This=0x804790, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x83491c) returned 0x0 [0215.484] WbemLocator:IClientSecurity:SetBlanket (This=0x83491c, pProxy=0x804790, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0215.484] WbemLocator:IUnknown:Release (This=0x83491c) returned 0x4 [0215.484] WbemLocator:IUnknown:Release (This=0x834940) returned 0x3 [0215.484] CoTaskMemFree (pv=0x888120) [0215.484] WbemLocator:IUnknown:Release (This=0x804790) returned 0x2 [0215.484] SysStringLen (param_1=0x0) returned 0x0 [0215.484] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8828f0, puCount=0x19f3ac | out: puCount=0x19f3ac*=0x2) returned 0x0 [0215.484] WbemDefPath:IWbemPath:GetText (in: This=0x8828f0, lFlags=4, puBuffLength=0x19f3a8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3a8*=0xf, pszText=0x0) returned 0x0 [0215.484] WbemDefPath:IWbemPath:GetText (in: This=0x8828f0, lFlags=4, puBuffLength=0x19f3a8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3a8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0215.484] CoGetContextToken (in: pToken=0x19f018 | out: pToken=0x19f018) returned 0x0 [0215.485] CoUnmarshalInterface (in: pStm=0x865530, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f008 | out: ppv=0x19f008*=0x834940) returned 0x0 [0215.485] CoMarshalInterface (pStm=0x865530, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x834940, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0215.485] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eeac | out: ppvObject=0x19eeac*=0x834940) returned 0x0 [0215.485] WbemLocator:IUnknown:Release (This=0x834940) returned 0x3 [0215.485] WbemLocator:IUnknown:Release (This=0x834940) returned 0x2 [0215.485] CoGetContextToken (in: pToken=0x19ef58 | out: pToken=0x19ef58) returned 0x0 [0215.485] WbemLocator:IUnknown:AddRef (This=0x834940) returned 0x3 [0215.486] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x83491c) returned 0x0 [0215.486] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x83491c, pProxy=0x834940, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0 [0215.486] WbemLocator:IUnknown:Release (This=0x83491c) returned 0x3 [0215.486] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x834940) returned 0x0 [0215.486] WbemLocator:IUnknown:QueryInterface (in: This=0x834940, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x83491c) returned 0x0 [0215.486] WbemLocator:IClientSecurity:SetBlanket (This=0x83491c, pProxy=0x834940, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0215.486] WbemLocator:IUnknown:Release (This=0x83491c) returned 0x4 [0215.486] WbemLocator:IUnknown:Release (This=0x834940) returned 0x3 [0215.486] WbemLocator:IUnknown:Release (This=0x834940) returned 0x2 [0215.486] SysStringLen (param_1=0x0) returned 0x0 [0215.486] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0215.486] WbemLocator:IUnknown:AddRef (This=0x804790) returned 0x3 [0215.486] WbemLocator:IUnknown:Release (This=0x804790) returned 0x2 [0215.487] CoGetContextToken (in: pToken=0x19f190 | out: pToken=0x19f190) returned 0x0 [0215.487] WbemLocator:IUnknown:AddRef (This=0x804790) returned 0x3 [0215.487] WbemLocator:IUnknown:QueryInterface (in: This=0x804790, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x83491c) returned 0x0 [0215.487] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x83491c, pProxy=0x804790, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0 [0215.487] WbemLocator:IUnknown:Release (This=0x83491c) returned 0x3 [0215.487] WbemLocator:IUnknown:QueryInterface (in: This=0x804790, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x834940) returned 0x0 [0215.487] WbemLocator:IUnknown:QueryInterface (in: This=0x804790, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x83491c) returned 0x0 [0215.487] WbemLocator:IClientSecurity:SetBlanket (This=0x83491c, pProxy=0x804790, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0215.487] WbemLocator:IUnknown:Release (This=0x83491c) returned 0x4 [0215.487] WbemLocator:IUnknown:Release (This=0x834940) returned 0x3 [0215.487] WbemLocator:IUnknown:Release (This=0x804790) returned 0x2 [0215.487] SysStringLen (param_1=0x0) returned 0x0 [0215.488] WbemDefPath:IWbemPath:GetText (in: This=0x82c278, lFlags=2, puBuffLength=0x19f3b0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3b0*=0x10, pszText=0x0) returned 0x0 [0215.488] WbemDefPath:IWbemPath:GetText (in: This=0x82c278, lFlags=2, puBuffLength=0x19f3b0*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f3b0*=0x10, pszText="win32_processor") returned 0x0 [0215.865] IWbemServices:GetObject (in: This=0x804790, strObjectPath="win32_processor", lFlags=0, pCtx=0x0, ppObject=0x19f364*=0x0, ppCallResult=0x0 | out: ppObject=0x19f364*=0x88c5c0, ppCallResult=0x0) returned 0x0 [0215.892] IWbemClassObject:Get (in: This=0x88c5c0, wszName="__PATH", lFlags=0, pVal=0x19f34c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3f4*=0, plFlavor=0x19f3f0*=0 | out: pVal=0x19f34c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor", varVal2=0x0), pType=0x19f3f4*=8, plFlavor=0x19f3f0*=64) returned 0x0 [0215.898] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x46 [0215.898] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x46 [0215.899] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x42c [0215.899] SetEvent (hEvent=0x3b0) returned 1 [0215.899] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f308*=0x42c, lpdwindex=0x19f124 | out: lpdwindex=0x19f124) returned 0x0 [0215.901] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0215.901] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0215.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x8877d8, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x8877d8) returned 0x0 [0215.901] WbemDefPath:IUnknown:AddRef (This=0x8877d8) returned 0x3 [0215.902] WbemDefPath:IUnknown:Release (This=0x8877d8) returned 0x2 [0215.902] WbemDefPath:IWbemPath:SetText (This=0x8877d8, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x0 [0215.902] IWbemClassObject:Get (in: This=0x88c5c0, wszName="__CLASS", lFlags=0, pVal=0x19f3bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f43c*=0, plFlavor=0x19f438*=0 | out: pVal=0x19f3bc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Processor", varVal2=0x0), pType=0x19f43c*=8, plFlavor=0x19f438*=64) returned 0x0 [0215.902] SysStringByteLen (bstr="Win32_Processor") returned 0x1e [0215.902] SysStringByteLen (bstr="Win32_Processor") returned 0x1e [0215.902] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0215.902] WbemLocator:IUnknown:AddRef (This=0x804790) returned 0x3 [0215.902] IWbemServices:CreateInstanceEnum (in: This=0x804790, strFilter="Win32_Processor", lFlags=17, pCtx=0x0, ppEnum=0x19f3b8 | out: ppEnum=0x19f3b8*=0x87e4b0) returned 0x0 [0215.905] IUnknown:QueryInterface (in: This=0x87e4b0, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f24c | out: ppvObject=0x19f24c*=0x87e4b4) returned 0x0 [0215.905] IClientSecurity:QueryBlanket (in: This=0x87e4b4, pProxy=0x87e4b0, pAuthnSvc=0x19f29c, pAuthzSvc=0x19f298, pServerPrincName=0x19f290, pAuthnLevel=0x19f294, pImpLevel=0x19f284, pAuthInfo=0x19f288, pCapabilites=0x19f28c | out: pAuthnSvc=0x19f29c*=0xa, pAuthzSvc=0x19f298*=0x0, pServerPrincName=0x19f290, pAuthnLevel=0x19f294*=0x6, pImpLevel=0x19f284*=0x2, pAuthInfo=0x19f288, pCapabilites=0x19f28c*=0x1) returned 0x0 [0215.905] IUnknown:Release (This=0x87e4b4) returned 0x1 [0215.905] IUnknown:QueryInterface (in: This=0x87e4b0, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f240 | out: ppvObject=0x19f240*=0x835440) returned 0x0 [0215.905] IUnknown:QueryInterface (in: This=0x87e4b0, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f23c | out: ppvObject=0x19f23c*=0x87e4b4) returned 0x0 [0215.905] IClientSecurity:SetBlanket (This=0x87e4b4, pProxy=0x87e4b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0215.983] IUnknown:Release (This=0x87e4b4) returned 0x2 [0215.983] WbemLocator:IUnknown:Release (This=0x835440) returned 0x1 [0215.983] CoTaskMemFree (pv=0x888180) [0215.984] IUnknown:QueryInterface (in: This=0x87e4b0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee34 | out: ppvObject=0x19ee34*=0x835440) returned 0x0 [0215.984] WbemLocator:IUnknown:QueryInterface (in: This=0x835440, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edf0 | out: ppvObject=0x19edf0*=0x0) returned 0x80004002 [0215.984] WbemLocator:IUnknown:QueryInterface (in: This=0x835440, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec0c | out: ppvObject=0x19ec0c*=0x0) returned 0x80004002 [0215.985] IUnknown:QueryInterface (in: This=0x87e4b0, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9e4 | out: ppvObject=0x19e9e4*=0x0) returned 0x80004002 [0215.985] WbemLocator:IUnknown:AddRef (This=0x835440) returned 0x3 [0215.985] WbemLocator:IUnknown:QueryInterface (in: This=0x835440, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e74c | out: ppvObject=0x19e74c*=0x0) returned 0x80004002 [0215.985] WbemLocator:IUnknown:QueryInterface (in: This=0x835440, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6fc | out: ppvObject=0x19e6fc*=0x0) returned 0x80004002 [0215.985] WbemLocator:IUnknown:QueryInterface (in: This=0x835440, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e708 | out: ppvObject=0x19e708*=0x83539c) returned 0x0 [0215.986] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x83539c, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e710 | out: pCid=0x19e710*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0215.986] WbemLocator:IUnknown:Release (This=0x83539c) returned 0x3 [0215.986] CoGetContextToken (in: pToken=0x19e768 | out: pToken=0x19e768) returned 0x0 [0215.986] CoGetContextToken (in: pToken=0x19eb70 | out: pToken=0x19eb70) returned 0x0 [0215.986] WbemLocator:IUnknown:QueryInterface (in: This=0x835440, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec00 | out: ppvObject=0x19ec00*=0x835424) returned 0x0 [0215.986] WbemLocator:IRpcOptions:Query (in: This=0x835424, pPrx=0x835440, dwProperty=2, pdwValue=0x19ec28 | out: pdwValue=0x19ec28) returned 0x80004002 [0215.986] WbemLocator:IUnknown:Release (This=0x835424) returned 0x3 [0215.986] WbemLocator:IUnknown:Release (This=0x835440) returned 0x2 [0215.986] CoGetContextToken (in: pToken=0x19f148 | out: pToken=0x19f148) returned 0x0 [0215.986] CoGetContextToken (in: pToken=0x19f0a8 | out: pToken=0x19f0a8) returned 0x0 [0215.986] WbemLocator:IUnknown:QueryInterface (in: This=0x835440, riid=0x19f178*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f174 | out: ppvObject=0x19f174*=0x87e4b0) returned 0x0 [0215.986] IUnknown:AddRef (This=0x87e4b0) returned 0x4 [0215.986] IUnknown:Release (This=0x87e4b0) returned 0x3 [0215.986] IUnknown:Release (This=0x87e4b0) returned 0x2 [0215.986] WbemLocator:IUnknown:Release (This=0x804790) returned 0x2 [0215.986] SysStringLen (param_1=0x0) returned 0x0 [0215.986] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8828f0, puCount=0x19f3f4 | out: puCount=0x19f3f4*=0x2) returned 0x0 [0215.986] WbemDefPath:IWbemPath:GetText (in: This=0x8828f0, lFlags=4, puBuffLength=0x19f3f0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3f0*=0xf, pszText=0x0) returned 0x0 [0215.987] WbemDefPath:IWbemPath:GetText (in: This=0x8828f0, lFlags=4, puBuffLength=0x19f3f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0215.987] CoGetContextToken (in: pToken=0x19f238 | out: pToken=0x19f238) returned 0x0 [0215.987] IUnknown:AddRef (This=0x87e4b0) returned 0x3 [0215.987] IEnumWbemClassObject:Clone (in: This=0x87e4b0, ppEnum=0x19f3f4 | out: ppEnum=0x19f3f4*=0x87e0c8) returned 0x0 [0215.988] IUnknown:QueryInterface (in: This=0x87e0c8, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2b8 | out: ppvObject=0x19f2b8*=0x87e0cc) returned 0x0 [0215.988] IClientSecurity:QueryBlanket (in: This=0x87e0cc, pProxy=0x87e0c8, pAuthnSvc=0x19f308, pAuthzSvc=0x19f304, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300, pImpLevel=0x19f2f0, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8 | out: pAuthnSvc=0x19f308*=0xa, pAuthzSvc=0x19f304*=0x0, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300*=0x6, pImpLevel=0x19f2f0*=0x2, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8*=0x1) returned 0x0 [0215.988] IUnknown:Release (This=0x87e0cc) returned 0x1 [0215.988] IUnknown:QueryInterface (in: This=0x87e0c8, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2ac | out: ppvObject=0x19f2ac*=0x835840) returned 0x0 [0215.988] IUnknown:QueryInterface (in: This=0x87e0c8, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2a8 | out: ppvObject=0x19f2a8*=0x87e0cc) returned 0x0 [0215.988] IClientSecurity:SetBlanket (This=0x87e0cc, pProxy=0x87e0c8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0215.989] IUnknown:Release (This=0x87e0cc) returned 0x2 [0215.989] WbemLocator:IUnknown:Release (This=0x835840) returned 0x1 [0215.990] CoTaskMemFree (pv=0x8884e0) [0215.990] IUnknown:QueryInterface (in: This=0x87e0c8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee94 | out: ppvObject=0x19ee94*=0x835840) returned 0x0 [0215.990] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee50 | out: ppvObject=0x19ee50*=0x0) returned 0x80004002 [0215.990] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec6c | out: ppvObject=0x19ec6c*=0x0) returned 0x80004002 [0215.991] IUnknown:QueryInterface (in: This=0x87e0c8, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea44 | out: ppvObject=0x19ea44*=0x0) returned 0x80004002 [0215.991] WbemLocator:IUnknown:AddRef (This=0x835840) returned 0x3 [0215.991] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ac | out: ppvObject=0x19e7ac*=0x0) returned 0x80004002 [0215.991] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e75c | out: ppvObject=0x19e75c*=0x0) returned 0x80004002 [0215.991] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e768 | out: ppvObject=0x19e768*=0x83579c) returned 0x0 [0215.991] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x83579c, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e770 | out: pCid=0x19e770*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0215.991] WbemLocator:IUnknown:Release (This=0x83579c) returned 0x3 [0215.991] CoGetContextToken (in: pToken=0x19e7c8 | out: pToken=0x19e7c8) returned 0x0 [0215.992] CoGetContextToken (in: pToken=0x19ebd0 | out: pToken=0x19ebd0) returned 0x0 [0215.992] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x835824) returned 0x0 [0215.992] WbemLocator:IRpcOptions:Query (in: This=0x835824, pPrx=0x835840, dwProperty=2, pdwValue=0x19ec88 | out: pdwValue=0x19ec88) returned 0x80004002 [0215.992] WbemLocator:IUnknown:Release (This=0x835824) returned 0x3 [0215.992] WbemLocator:IUnknown:Release (This=0x835840) returned 0x2 [0215.992] CoGetContextToken (in: pToken=0x19f1a8 | out: pToken=0x19f1a8) returned 0x0 [0215.992] CoGetContextToken (in: pToken=0x19f108 | out: pToken=0x19f108) returned 0x0 [0215.992] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x19f1d8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f1d4 | out: ppvObject=0x19f1d4*=0x87e0c8) returned 0x0 [0215.992] IUnknown:AddRef (This=0x87e0c8) returned 0x4 [0215.992] IUnknown:Release (This=0x87e0c8) returned 0x3 [0215.992] IUnknown:Release (This=0x87e0c8) returned 0x2 [0215.992] IUnknown:Release (This=0x87e4b0) returned 0x2 [0215.992] SysStringLen (param_1=0x0) returned 0x0 [0215.993] IEnumWbemClassObject:Reset (This=0x87e0c8) returned 0x0 [0215.996] CoTaskMemAlloc (cb=0x4) returned 0x887dc8 [0215.997] IEnumWbemClassObject:Next (in: This=0x87e0c8, lTimeout=-1, uCount=0x1, apObjects=0x887dc8, puReturned=0x2316b70 | out: apObjects=0x887dc8*=0x89b7e8, puReturned=0x2316b70*=0x1) returned 0x0 [0234.236] IUnknown:QueryInterface (in: This=0x89b7e8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x89b7e8) returned 0x0 [0234.236] IUnknown:QueryInterface (in: This=0x89b7e8, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0234.236] IUnknown:QueryInterface (in: This=0x89b7e8, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0234.236] IUnknown:QueryInterface (in: This=0x89b7e8, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0234.237] IUnknown:AddRef (This=0x89b7e8) returned 0x3 [0234.237] IUnknown:QueryInterface (in: This=0x89b7e8, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0234.237] IUnknown:QueryInterface (in: This=0x89b7e8, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0234.237] IUnknown:QueryInterface (in: This=0x89b7e8, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x89b7ec) returned 0x0 [0234.237] IMarshal:GetUnmarshalClass (in: This=0x89b7ec, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.237] IUnknown:Release (This=0x89b7ec) returned 0x3 [0234.237] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0234.237] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0234.237] IUnknown:QueryInterface (in: This=0x89b7e8, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0234.237] IUnknown:Release (This=0x89b7e8) returned 0x2 [0234.237] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0234.238] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0234.238] IUnknown:QueryInterface (in: This=0x89b7e8, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x89b7e8) returned 0x0 [0234.238] IUnknown:AddRef (This=0x89b7e8) returned 0x4 [0234.238] IUnknown:Release (This=0x89b7e8) returned 0x3 [0234.238] IUnknown:Release (This=0x89b7e8) returned 0x2 [0234.239] CoTaskMemFree (pv=0x887dc8) [0234.239] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0234.239] IUnknown:AddRef (This=0x89b7e8) returned 0x3 [0234.240] IWbemClassObject:Get (in: This=0x89b7e8, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0234.240] IWbemClassObject:Get (in: This=0x89b7e8, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0234.241] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0234.244] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0234.244] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x430 [0234.244] SetEvent (hEvent=0x3b0) returned 1 [0234.245] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x430, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0234.253] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0234.253] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0234.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x86bb90, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x86bb90) returned 0x0 [0234.253] WbemDefPath:IUnknown:AddRef (This=0x86bb90) returned 0x3 [0234.253] WbemDefPath:IUnknown:Release (This=0x86bb90) returned 0x2 [0234.253] WbemDefPath:IWbemPath:SetText (This=0x86bb90, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0234.253] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8828f0, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0234.253] WbemDefPath:IWbemPath:GetText (in: This=0x8828f0, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0234.253] WbemDefPath:IWbemPath:GetText (in: This=0x8828f0, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.254] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8828f0, puCount=0x19f400 | out: puCount=0x19f400*=0x2) returned 0x0 [0234.254] WbemDefPath:IWbemPath:GetText (in: This=0x8828f0, lFlags=4, puBuffLength=0x19f3fc*=0x0, pszText=0x0 | out: puBuffLength=0x19f3fc*=0xf, pszText=0x0) returned 0x0 [0234.254] WbemDefPath:IWbemPath:GetText (in: This=0x8828f0, lFlags=4, puBuffLength=0x19f3fc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3fc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.259] IWbemClassObject:Get (in: This=0x89b7e8, wszName="processorID", lFlags=0, pVal=0x19f3fc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317420*=0, plFlavor=0x2317424*=0 | out: pVal=0x19f3fc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF00050654", varVal2=0x0), pType=0x2317420*=8, plFlavor=0x2317424*=0) returned 0x0 [0234.259] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0234.259] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0234.259] IWbemClassObject:Get (in: This=0x89b7e8, wszName="processorID", lFlags=0, pVal=0x19f404*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2317420*=8, plFlavor=0x2317424*=0 | out: pVal=0x19f404*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF00050654", varVal2=0x0), pType=0x2317420*=8, plFlavor=0x2317424*=0) returned 0x0 [0234.259] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0234.259] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0234.260] CoTaskMemAlloc (cb=0x4) returned 0x887dc8 [0234.260] IEnumWbemClassObject:Next (in: This=0x87e0c8, lTimeout=-1, uCount=0x1, apObjects=0x887dc8, puReturned=0x2316b70 | out: apObjects=0x887dc8*=0x0, puReturned=0x2316b70*=0x0) returned 0x1 [0234.264] CoTaskMemFree (pv=0x887dc8) [0234.265] CoGetContextToken (in: pToken=0x19f320 | out: pToken=0x19f320) returned 0x0 [0234.265] WbemLocator:IUnknown:Release (This=0x835840) returned 0x1 [0234.265] IUnknown:Release (This=0x87e0c8) returned 0x0 [0234.293] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x434 [0234.293] SetEvent (hEvent=0x3b0) returned 1 [0234.294] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3c4*=0x434, lpdwindex=0x19f1e4 | out: lpdwindex=0x19f1e4) returned 0x0 [0234.299] CoGetContextToken (in: pToken=0x19f290 | out: pToken=0x19f290) returned 0x0 [0234.299] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0 [0234.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x862c38, riid=0x19f2c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f2bc | out: ppvObject=0x19f2bc*=0x862c38) returned 0x0 [0234.299] WbemDefPath:IUnknown:AddRef (This=0x862c38) returned 0x3 [0234.299] WbemDefPath:IUnknown:Release (This=0x862c38) returned 0x2 [0234.299] WbemDefPath:IWbemPath:SetText (This=0x862c38, uMode=0x4, pszPath="Win32_NetworkAdapterConfiguration") returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x862c38, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetText (in: This=0x862c38, lFlags=2, puBuffLength=0x19f440*=0x0, pszText=0x0 | out: puBuffLength=0x19f440*=0x22, pszText=0x0) returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetText (in: This=0x862c38, lFlags=2, puBuffLength=0x19f440*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x19f440*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetInfo (in: This=0x862c38, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x862c38, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetInfo (in: This=0x862c38, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x862c38, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetText (in: This=0x862c38, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x22, pszText=0x0) returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetText (in: This=0x862c38, lFlags=2, puBuffLength=0x19f430*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x19f430*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x862c38, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetText (in: This=0x862c38, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x22, pszText=0x0) returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetText (in: This=0x862c38, lFlags=2, puBuffLength=0x19f430*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x19f430*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x862c38, puCount=0x19f3c4 | out: puCount=0x19f3c4*=0x0) returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f3b0 | out: puCount=0x19f3b0*=0x2) returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f3ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f3ac*=0xf, pszText=0x0) returned 0x0 [0234.299] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f3ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.299] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x438 [0234.300] SetEvent (hEvent=0x3b0) returned 1 [0234.300] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f30c*=0x438, lpdwindex=0x19f12c | out: lpdwindex=0x19f12c) returned 0x0 [0234.302] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0234.302] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0234.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x863098, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x863098) returned 0x0 [0234.302] WbemDefPath:IUnknown:AddRef (This=0x863098) returned 0x3 [0234.302] WbemDefPath:IUnknown:Release (This=0x863098) returned 0x2 [0234.302] WbemDefPath:IWbemPath:SetText (This=0x863098, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0234.302] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f388 | out: puCount=0x19f388*=0x2) returned 0x0 [0234.302] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f384*=0x0, pszText=0x0 | out: puBuffLength=0x19f384*=0xf, pszText=0x0) returned 0x0 [0234.302] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f384*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f384*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.323] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f2a8*=0x44c, lpdwindex=0x19f15c | out: lpdwindex=0x19f15c) returned 0x0 [0234.358] CoGetContextToken (in: pToken=0x19f0a0 | out: pToken=0x19f0a0) returned 0x0 [0234.358] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0234.358] IUnknown:QueryInterface (in: This=0x810138, riid=0x6b2e8724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f028 | out: ppvObject=0x19f028*=0x810148) returned 0x0 [0234.358] CObjectContext::ContextCallback () returned 0x0 [0234.361] IUnknown:Release (This=0x810148) returned 0x1 [0234.361] CoUnmarshalInterface (in: pStm=0x865610, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f090 | out: ppv=0x19f090*=0x835840) returned 0x0 [0234.361] CoMarshalInterface (pStm=0x865610, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x835840, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0234.361] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef34 | out: ppvObject=0x19ef34*=0x835840) returned 0x0 [0234.362] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19eef0 | out: ppvObject=0x19eef0*=0x0) returned 0x80004002 [0234.364] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x0) returned 0x80004002 [0234.365] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19eae4 | out: ppvObject=0x19eae4*=0x0) returned 0x80004002 [0234.365] WbemLocator:IUnknown:AddRef (This=0x835840) returned 0x3 [0234.365] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e84c | out: ppvObject=0x19e84c*=0x0) returned 0x80004002 [0234.365] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.365] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e808 | out: ppvObject=0x19e808*=0x83579c) returned 0x0 [0234.365] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x83579c, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e810 | out: pCid=0x19e810*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.365] WbemLocator:IUnknown:Release (This=0x83579c) returned 0x3 [0234.365] CoGetContextToken (in: pToken=0x19e868 | out: pToken=0x19e868) returned 0x0 [0234.365] CoGetContextToken (in: pToken=0x19ec70 | out: pToken=0x19ec70) returned 0x0 [0234.365] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed00 | out: ppvObject=0x19ed00*=0x835824) returned 0x0 [0234.366] WbemLocator:IRpcOptions:Query (in: This=0x835824, pPrx=0x835840, dwProperty=2, pdwValue=0x19ed28 | out: pdwValue=0x19ed28) returned 0x0 [0234.366] WbemLocator:IUnknown:Release (This=0x835824) returned 0x3 [0234.366] WbemLocator:IUnknown:Release (This=0x835840) returned 0x2 [0234.366] WbemLocator:IUnknown:Release (This=0x835840) returned 0x1 [0234.366] CoGetContextToken (in: pToken=0x19efe0 | out: pToken=0x19efe0) returned 0x0 [0234.366] WbemLocator:IUnknown:AddRef (This=0x835840) returned 0x2 [0234.366] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x83581c) returned 0x0 [0234.366] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x83581c, pProxy=0x835840, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0 [0234.366] WbemLocator:IUnknown:Release (This=0x83581c) returned 0x2 [0234.366] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x835840) returned 0x0 [0234.366] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x83581c) returned 0x0 [0234.366] WbemLocator:IClientSecurity:SetBlanket (This=0x83581c, pProxy=0x835840, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0234.367] WbemLocator:IUnknown:Release (This=0x83581c) returned 0x3 [0234.367] WbemLocator:IUnknown:Release (This=0x835840) returned 0x2 [0234.367] CoTaskMemFree (pv=0x888180) [0234.367] WbemLocator:IUnknown:Release (This=0x835840) returned 0x1 [0234.367] SysStringLen (param_1=0x0) returned 0x0 [0234.367] CoGetContextToken (in: pToken=0x19f258 | out: pToken=0x19f258) returned 0x0 [0234.367] CoGetContextToken (in: pToken=0x19f1b8 | out: pToken=0x19f1b8) returned 0x0 [0234.367] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x19f288*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x8a42b8) returned 0x0 [0234.368] WbemLocator:IUnknown:AddRef (This=0x8a42b8) returned 0x3 [0234.368] WbemLocator:IUnknown:Release (This=0x8a42b8) returned 0x2 [0234.368] CoGetContextToken (in: pToken=0x19f218 | out: pToken=0x19f218) returned 0x0 [0234.368] WbemLocator:IUnknown:AddRef (This=0x8a42b8) returned 0x3 [0234.368] WbemLocator:IUnknown:QueryInterface (in: This=0x8a42b8, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x83581c) returned 0x0 [0234.368] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x83581c, pProxy=0x8a42b8, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0 [0234.368] WbemLocator:IUnknown:Release (This=0x83581c) returned 0x3 [0234.368] WbemLocator:IUnknown:QueryInterface (in: This=0x8a42b8, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x835840) returned 0x0 [0234.368] WbemLocator:IUnknown:QueryInterface (in: This=0x8a42b8, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x83581c) returned 0x0 [0234.368] WbemLocator:IClientSecurity:SetBlanket (This=0x83581c, pProxy=0x8a42b8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0234.368] WbemLocator:IUnknown:Release (This=0x83581c) returned 0x4 [0234.368] WbemLocator:IUnknown:Release (This=0x835840) returned 0x3 [0234.368] CoTaskMemFree (pv=0x888090) [0234.369] WbemLocator:IUnknown:Release (This=0x8a42b8) returned 0x2 [0234.369] SysStringLen (param_1=0x0) returned 0x0 [0234.369] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f3ac | out: puCount=0x19f3ac*=0x2) returned 0x0 [0234.369] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3a8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3a8*=0xf, pszText=0x0) returned 0x0 [0234.369] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3a8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3a8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.369] CoGetContextToken (in: pToken=0x19f018 | out: pToken=0x19f018) returned 0x0 [0234.369] CoUnmarshalInterface (in: pStm=0x865610, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f008 | out: ppv=0x19f008*=0x835840) returned 0x0 [0234.369] CoMarshalInterface (pStm=0x865610, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x835840, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0234.370] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eeac | out: ppvObject=0x19eeac*=0x835840) returned 0x0 [0234.370] WbemLocator:IUnknown:Release (This=0x835840) returned 0x3 [0234.370] WbemLocator:IUnknown:Release (This=0x835840) returned 0x2 [0234.370] CoGetContextToken (in: pToken=0x19ef58 | out: pToken=0x19ef58) returned 0x0 [0234.370] WbemLocator:IUnknown:AddRef (This=0x835840) returned 0x3 [0234.370] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x83581c) returned 0x0 [0234.370] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x83581c, pProxy=0x835840, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0 [0234.370] WbemLocator:IUnknown:Release (This=0x83581c) returned 0x3 [0234.370] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x835840) returned 0x0 [0234.370] WbemLocator:IUnknown:QueryInterface (in: This=0x835840, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x83581c) returned 0x0 [0234.370] WbemLocator:IClientSecurity:SetBlanket (This=0x83581c, pProxy=0x835840, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0234.371] WbemLocator:IUnknown:Release (This=0x83581c) returned 0x4 [0234.371] WbemLocator:IUnknown:Release (This=0x835840) returned 0x3 [0234.371] WbemLocator:IUnknown:Release (This=0x835840) returned 0x2 [0234.371] SysStringLen (param_1=0x0) returned 0x0 [0234.371] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0234.371] WbemLocator:IUnknown:AddRef (This=0x8a42b8) returned 0x3 [0234.371] WbemLocator:IUnknown:Release (This=0x8a42b8) returned 0x2 [0234.371] CoGetContextToken (in: pToken=0x19f190 | out: pToken=0x19f190) returned 0x0 [0234.371] WbemLocator:IUnknown:AddRef (This=0x8a42b8) returned 0x3 [0234.371] WbemLocator:IUnknown:QueryInterface (in: This=0x8a42b8, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x83581c) returned 0x0 [0234.371] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x83581c, pProxy=0x8a42b8, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0 [0234.371] WbemLocator:IUnknown:Release (This=0x83581c) returned 0x3 [0234.371] WbemLocator:IUnknown:QueryInterface (in: This=0x8a42b8, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x835840) returned 0x0 [0234.371] WbemLocator:IUnknown:QueryInterface (in: This=0x8a42b8, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x83581c) returned 0x0 [0234.371] WbemLocator:IClientSecurity:SetBlanket (This=0x83581c, pProxy=0x8a42b8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0234.371] WbemLocator:IUnknown:Release (This=0x83581c) returned 0x4 [0234.372] WbemLocator:IUnknown:Release (This=0x835840) returned 0x3 [0234.372] WbemLocator:IUnknown:Release (This=0x8a42b8) returned 0x2 [0234.372] SysStringLen (param_1=0x0) returned 0x0 [0234.372] WbemDefPath:IWbemPath:GetText (in: This=0x862c38, lFlags=2, puBuffLength=0x19f3b0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3b0*=0x22, pszText=0x0) returned 0x0 [0234.372] WbemDefPath:IWbemPath:GetText (in: This=0x862c38, lFlags=2, puBuffLength=0x19f3b0*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x19f3b0*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0234.374] IWbemServices:GetObject (in: This=0x8a42b8, strObjectPath="Win32_NetworkAdapterConfiguration", lFlags=0, pCtx=0x0, ppObject=0x19f364*=0x0, ppCallResult=0x0 | out: ppObject=0x19f364*=0x89aa98, ppCallResult=0x0) returned 0x0 [0234.412] IWbemClassObject:Get (in: This=0x89aa98, wszName="__PATH", lFlags=0, pVal=0x19f34c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3f4*=0, plFlavor=0x19f3f0*=0 | out: pVal=0x19f34c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration", varVal2=0x0), pType=0x19f3f4*=8, plFlavor=0x19f3f0*=64) returned 0x0 [0234.412] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x6a [0234.413] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x6a [0234.413] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x450 [0234.413] SetEvent (hEvent=0x3b0) returned 1 [0234.413] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f308*=0x450, lpdwindex=0x19f124 | out: lpdwindex=0x19f124) returned 0x0 [0234.416] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0234.416] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0234.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x862ca8, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x862ca8) returned 0x0 [0234.416] WbemDefPath:IUnknown:AddRef (This=0x862ca8) returned 0x3 [0234.416] WbemDefPath:IUnknown:Release (This=0x862ca8) returned 0x2 [0234.416] WbemDefPath:IWbemPath:SetText (This=0x862ca8, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x0 [0234.416] IWbemClassObject:Get (in: This=0x89aa98, wszName="__CLASS", lFlags=0, pVal=0x19f3bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f43c*=0, plFlavor=0x19f438*=0 | out: pVal=0x19f3bc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_NetworkAdapterConfiguration", varVal2=0x0), pType=0x19f43c*=8, plFlavor=0x19f438*=64) returned 0x0 [0234.416] SysStringByteLen (bstr="Win32_NetworkAdapterConfiguration") returned 0x42 [0234.416] SysStringByteLen (bstr="Win32_NetworkAdapterConfiguration") returned 0x42 [0234.416] CoGetContextToken (in: pToken=0x19f1b0 | out: pToken=0x19f1b0) returned 0x0 [0234.416] WbemLocator:IUnknown:AddRef (This=0x8a42b8) returned 0x3 [0234.416] IWbemServices:CreateInstanceEnum (in: This=0x8a42b8, strFilter="Win32_NetworkAdapterConfiguration", lFlags=17, pCtx=0x0, ppEnum=0x19f3b8 | out: ppEnum=0x19f3b8*=0x87e708) returned 0x0 [0234.426] IUnknown:QueryInterface (in: This=0x87e708, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f228 | out: ppvObject=0x19f228*=0x87e70c) returned 0x0 [0234.426] IClientSecurity:QueryBlanket (in: This=0x87e70c, pProxy=0x87e708, pAuthnSvc=0x19f278, pAuthzSvc=0x19f274, pServerPrincName=0x19f26c, pAuthnLevel=0x19f270, pImpLevel=0x19f260, pAuthInfo=0x19f264, pCapabilites=0x19f268 | out: pAuthnSvc=0x19f278*=0xa, pAuthzSvc=0x19f274*=0x0, pServerPrincName=0x19f26c, pAuthnLevel=0x19f270*=0x6, pImpLevel=0x19f260*=0x2, pAuthInfo=0x19f264, pCapabilites=0x19f268*=0x1) returned 0x0 [0234.426] IUnknown:Release (This=0x87e70c) returned 0x1 [0234.426] IUnknown:QueryInterface (in: This=0x87e708, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f21c | out: ppvObject=0x19f21c*=0x89c608) returned 0x0 [0234.427] IUnknown:QueryInterface (in: This=0x87e708, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f218 | out: ppvObject=0x19f218*=0x87e70c) returned 0x0 [0234.427] IClientSecurity:SetBlanket (This=0x87e70c, pProxy=0x87e708, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0234.463] IUnknown:Release (This=0x87e70c) returned 0x2 [0234.463] WbemLocator:IUnknown:Release (This=0x89c608) returned 0x1 [0234.464] CoTaskMemFree (pv=0x887f70) [0234.464] IUnknown:QueryInterface (in: This=0x87e708, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee10 | out: ppvObject=0x19ee10*=0x89c608) returned 0x0 [0234.464] WbemLocator:IUnknown:QueryInterface (in: This=0x89c608, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edcc | out: ppvObject=0x19edcc*=0x0) returned 0x80004002 [0234.465] WbemLocator:IUnknown:QueryInterface (in: This=0x89c608, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ebec | out: ppvObject=0x19ebec*=0x0) returned 0x80004002 [0234.466] IUnknown:QueryInterface (in: This=0x87e708, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9c4 | out: ppvObject=0x19e9c4*=0x0) returned 0x80004002 [0234.467] WbemLocator:IUnknown:AddRef (This=0x89c608) returned 0x3 [0234.467] WbemLocator:IUnknown:QueryInterface (in: This=0x89c608, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e72c | out: ppvObject=0x19e72c*=0x0) returned 0x80004002 [0234.467] WbemLocator:IUnknown:QueryInterface (in: This=0x89c608, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6dc | out: ppvObject=0x19e6dc*=0x0) returned 0x80004002 [0234.467] WbemLocator:IUnknown:QueryInterface (in: This=0x89c608, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6e8 | out: ppvObject=0x19e6e8*=0x89c564) returned 0x0 [0234.467] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89c564, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e6f0 | out: pCid=0x19e6f0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.467] WbemLocator:IUnknown:Release (This=0x89c564) returned 0x3 [0234.467] CoGetContextToken (in: pToken=0x19e748 | out: pToken=0x19e748) returned 0x0 [0234.467] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.467] WbemLocator:IUnknown:QueryInterface (in: This=0x89c608, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebe0 | out: ppvObject=0x19ebe0*=0x89c5ec) returned 0x0 [0234.467] WbemLocator:IRpcOptions:Query (in: This=0x89c5ec, pPrx=0x89c608, dwProperty=2, pdwValue=0x19ec08 | out: pdwValue=0x19ec08) returned 0x80004002 [0234.468] WbemLocator:IUnknown:Release (This=0x89c5ec) returned 0x3 [0234.468] WbemLocator:IUnknown:Release (This=0x89c608) returned 0x2 [0234.468] CoGetContextToken (in: pToken=0x19f120 | out: pToken=0x19f120) returned 0x0 [0234.468] CoGetContextToken (in: pToken=0x19f080 | out: pToken=0x19f080) returned 0x0 [0234.468] WbemLocator:IUnknown:QueryInterface (in: This=0x89c608, riid=0x19f150*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f14c | out: ppvObject=0x19f14c*=0x87e708) returned 0x0 [0234.468] IUnknown:AddRef (This=0x87e708) returned 0x4 [0234.468] IUnknown:Release (This=0x87e708) returned 0x3 [0234.468] IUnknown:Release (This=0x87e708) returned 0x2 [0234.468] WbemLocator:IUnknown:Release (This=0x8a42b8) returned 0x2 [0234.468] SysStringLen (param_1=0x0) returned 0x0 [0234.468] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f3f4 | out: puCount=0x19f3f4*=0x2) returned 0x0 [0234.468] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3f0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3f0*=0xf, pszText=0x0) returned 0x0 [0234.468] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.468] CoGetContextToken (in: pToken=0x19f238 | out: pToken=0x19f238) returned 0x0 [0234.468] IUnknown:AddRef (This=0x87e708) returned 0x3 [0234.468] IEnumWbemClassObject:Clone (in: This=0x87e708, ppEnum=0x19f3f4 | out: ppEnum=0x19f3f4*=0x87e000) returned 0x0 [0234.540] IUnknown:QueryInterface (in: This=0x87e000, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2b8 | out: ppvObject=0x19f2b8*=0x87e004) returned 0x0 [0234.540] IClientSecurity:QueryBlanket (in: This=0x87e004, pProxy=0x87e000, pAuthnSvc=0x19f308, pAuthzSvc=0x19f304, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300, pImpLevel=0x19f2f0, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8 | out: pAuthnSvc=0x19f308*=0xa, pAuthzSvc=0x19f304*=0x0, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300*=0x6, pImpLevel=0x19f2f0*=0x2, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8*=0x1) returned 0x0 [0234.540] IUnknown:Release (This=0x87e004) returned 0x1 [0234.541] IUnknown:QueryInterface (in: This=0x87e000, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2ac | out: ppvObject=0x19f2ac*=0x89c408) returned 0x0 [0234.541] IUnknown:QueryInterface (in: This=0x87e000, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2a8 | out: ppvObject=0x19f2a8*=0x87e004) returned 0x0 [0234.541] IClientSecurity:SetBlanket (This=0x87e004, pProxy=0x87e000, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0234.574] IUnknown:Release (This=0x87e004) returned 0x2 [0234.574] WbemLocator:IUnknown:Release (This=0x89c408) returned 0x1 [0234.574] CoTaskMemFree (pv=0x888090) [0234.574] IUnknown:QueryInterface (in: This=0x87e000, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee94 | out: ppvObject=0x19ee94*=0x89c408) returned 0x0 [0234.575] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee50 | out: ppvObject=0x19ee50*=0x0) returned 0x80004002 [0234.580] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec6c | out: ppvObject=0x19ec6c*=0x0) returned 0x80004002 [0234.632] IUnknown:QueryInterface (in: This=0x87e000, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea44 | out: ppvObject=0x19ea44*=0x0) returned 0x80004002 [0234.644] WbemLocator:IUnknown:AddRef (This=0x89c408) returned 0x3 [0234.644] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ac | out: ppvObject=0x19e7ac*=0x0) returned 0x80004002 [0234.644] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e75c | out: ppvObject=0x19e75c*=0x0) returned 0x80004002 [0234.644] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e768 | out: ppvObject=0x19e768*=0x89c364) returned 0x0 [0234.645] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89c364, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e770 | out: pCid=0x19e770*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.645] WbemLocator:IUnknown:Release (This=0x89c364) returned 0x3 [0234.645] CoGetContextToken (in: pToken=0x19e7c8 | out: pToken=0x19e7c8) returned 0x0 [0234.645] CoGetContextToken (in: pToken=0x19ebd0 | out: pToken=0x19ebd0) returned 0x0 [0234.645] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x89c3ec) returned 0x0 [0234.645] WbemLocator:IRpcOptions:Query (in: This=0x89c3ec, pPrx=0x89c408, dwProperty=2, pdwValue=0x19ec88 | out: pdwValue=0x19ec88) returned 0x80004002 [0234.645] WbemLocator:IUnknown:Release (This=0x89c3ec) returned 0x3 [0234.645] WbemLocator:IUnknown:Release (This=0x89c408) returned 0x2 [0234.645] CoGetContextToken (in: pToken=0x19f1a8 | out: pToken=0x19f1a8) returned 0x0 [0234.645] CoGetContextToken (in: pToken=0x19f108 | out: pToken=0x19f108) returned 0x0 [0234.645] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x19f1d8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f1d4 | out: ppvObject=0x19f1d4*=0x87e000) returned 0x0 [0234.645] IUnknown:AddRef (This=0x87e000) returned 0x4 [0234.645] IUnknown:Release (This=0x87e000) returned 0x3 [0234.645] IUnknown:Release (This=0x87e000) returned 0x2 [0234.645] IUnknown:Release (This=0x87e708) returned 0x2 [0234.646] SysStringLen (param_1=0x0) returned 0x0 [0234.646] IEnumWbemClassObject:Reset (This=0x87e000) returned 0x0 [0234.704] CoTaskMemAlloc (cb=0x4) returned 0x887c78 [0234.704] IEnumWbemClassObject:Next (in: This=0x87e000, lTimeout=-1, uCount=0x1, apObjects=0x887c78, puReturned=0x2319078 | out: apObjects=0x887c78*=0x89b650, puReturned=0x2319078*=0x1) returned 0x0 [0234.779] IUnknown:QueryInterface (in: This=0x89b650, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x89b650) returned 0x0 [0234.780] IUnknown:QueryInterface (in: This=0x89b650, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0234.780] IUnknown:QueryInterface (in: This=0x89b650, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0234.780] IUnknown:QueryInterface (in: This=0x89b650, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0234.780] IUnknown:AddRef (This=0x89b650) returned 0x3 [0234.780] IUnknown:QueryInterface (in: This=0x89b650, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0234.780] IUnknown:QueryInterface (in: This=0x89b650, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0234.780] IUnknown:QueryInterface (in: This=0x89b650, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x89b654) returned 0x0 [0234.780] IMarshal:GetUnmarshalClass (in: This=0x89b654, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.780] IUnknown:Release (This=0x89b654) returned 0x3 [0234.780] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0234.780] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0234.781] IUnknown:QueryInterface (in: This=0x89b650, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0234.781] IUnknown:Release (This=0x89b650) returned 0x2 [0234.781] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0234.781] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0234.781] IUnknown:QueryInterface (in: This=0x89b650, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x89b650) returned 0x0 [0234.781] IUnknown:AddRef (This=0x89b650) returned 0x4 [0234.781] IUnknown:Release (This=0x89b650) returned 0x3 [0234.781] IUnknown:Release (This=0x89b650) returned 0x2 [0234.781] CoTaskMemFree (pv=0x887c78) [0234.781] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0234.781] IUnknown:AddRef (This=0x89b650) returned 0x3 [0234.781] IWbemClassObject:Get (in: This=0x89b650, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0234.781] IWbemClassObject:Get (in: This=0x89b650, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0234.782] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x7a [0234.782] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x7a [0234.782] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x454 [0234.782] SetEvent (hEvent=0x3b0) returned 1 [0234.782] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x454, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0234.786] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0234.786] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0234.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x862e68, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x862e68) returned 0x0 [0234.786] WbemDefPath:IUnknown:AddRef (This=0x862e68) returned 0x3 [0234.786] WbemDefPath:IUnknown:Release (This=0x862e68) returned 0x2 [0234.786] WbemDefPath:IWbemPath:SetText (This=0x862e68, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x0 [0234.786] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0234.786] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0234.786] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.790] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0234.790] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0234.790] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.790] IWbemClassObject:Get (in: This=0x89b650, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2319910*=0, plFlavor=0x2319914*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2319910*=11, plFlavor=0x2319914*=0) returned 0x0 [0234.790] IWbemClassObject:Get (in: This=0x89b650, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2319910*=11, plFlavor=0x2319914*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2319910*=11, plFlavor=0x2319914*=0) returned 0x0 [0234.838] IUnknown:Release (This=0x89b650) returned 0x2 [0234.840] CoTaskMemAlloc (cb=0x4) returned 0x887b78 [0234.841] IEnumWbemClassObject:Next (in: This=0x87e000, lTimeout=-1, uCount=0x1, apObjects=0x887b78, puReturned=0x2319078 | out: apObjects=0x887b78*=0x89b188, puReturned=0x2319078*=0x1) returned 0x0 [0234.842] IUnknown:QueryInterface (in: This=0x89b188, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x89b188) returned 0x0 [0234.844] IUnknown:QueryInterface (in: This=0x89b188, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0234.844] IUnknown:QueryInterface (in: This=0x89b188, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0234.845] IUnknown:QueryInterface (in: This=0x89b188, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0234.845] IUnknown:AddRef (This=0x89b188) returned 0x3 [0234.845] IUnknown:QueryInterface (in: This=0x89b188, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0234.845] IUnknown:QueryInterface (in: This=0x89b188, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0234.845] IUnknown:QueryInterface (in: This=0x89b188, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x89b18c) returned 0x0 [0234.845] IMarshal:GetUnmarshalClass (in: This=0x89b18c, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.845] IUnknown:Release (This=0x89b18c) returned 0x3 [0234.845] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0234.845] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0234.845] IUnknown:QueryInterface (in: This=0x89b188, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0234.845] IUnknown:Release (This=0x89b188) returned 0x2 [0234.845] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0234.845] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0234.845] IUnknown:QueryInterface (in: This=0x89b188, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x89b188) returned 0x0 [0234.845] IUnknown:AddRef (This=0x89b188) returned 0x4 [0234.845] IUnknown:Release (This=0x89b188) returned 0x3 [0234.845] IUnknown:Release (This=0x89b188) returned 0x2 [0234.845] CoTaskMemFree (pv=0x887b78) [0234.845] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0234.846] IUnknown:AddRef (This=0x89b188) returned 0x3 [0234.846] IWbemClassObject:Get (in: This=0x89b188, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0234.846] IWbemClassObject:Get (in: This=0x89b188, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0234.846] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x7a [0234.846] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x7a [0234.846] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x458 [0234.846] SetEvent (hEvent=0x3b0) returned 1 [0234.846] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x458, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0234.849] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0234.849] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0234.849] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x862df8) returned 0x0 [0234.849] WbemDefPath:IUnknown:AddRef (This=0x862df8) returned 0x3 [0234.849] WbemDefPath:IUnknown:Release (This=0x862df8) returned 0x2 [0234.849] WbemDefPath:IWbemPath:SetText (This=0x862df8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x0 [0234.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0234.849] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0234.849] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0234.850] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0234.850] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.850] IWbemClassObject:Get (in: This=0x89b188, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231a3e8*=0, plFlavor=0x231a3ec*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231a3e8*=11, plFlavor=0x231a3ec*=0) returned 0x0 [0234.850] IWbemClassObject:Get (in: This=0x89b188, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231a3e8*=11, plFlavor=0x231a3ec*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231a3e8*=11, plFlavor=0x231a3ec*=0) returned 0x0 [0234.850] IUnknown:Release (This=0x89b188) returned 0x2 [0234.850] CoTaskMemAlloc (cb=0x4) returned 0x887b18 [0234.850] IEnumWbemClassObject:Next (in: This=0x87e000, lTimeout=-1, uCount=0x1, apObjects=0x887b18, puReturned=0x2319078 | out: apObjects=0x887b18*=0x89b980, puReturned=0x2319078*=0x1) returned 0x0 [0234.853] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x89b980) returned 0x0 [0234.853] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0234.853] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0234.853] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0234.854] IUnknown:AddRef (This=0x89b980) returned 0x3 [0234.854] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0234.854] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0234.854] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x89b984) returned 0x0 [0234.854] IMarshal:GetUnmarshalClass (in: This=0x89b984, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.854] IUnknown:Release (This=0x89b984) returned 0x3 [0234.854] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0234.854] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0234.854] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0234.854] IUnknown:Release (This=0x89b980) returned 0x2 [0234.854] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0234.854] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0234.854] IUnknown:QueryInterface (in: This=0x89b980, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x89b980) returned 0x0 [0234.854] IUnknown:AddRef (This=0x89b980) returned 0x4 [0234.854] IUnknown:Release (This=0x89b980) returned 0x3 [0234.854] IUnknown:Release (This=0x89b980) returned 0x2 [0234.854] CoTaskMemFree (pv=0x887b18) [0234.854] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0234.854] IUnknown:AddRef (This=0x89b980) returned 0x3 [0234.854] IWbemClassObject:Get (in: This=0x89b980, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0234.855] IWbemClassObject:Get (in: This=0x89b980, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0234.855] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x7a [0234.855] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x7a [0234.855] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x460 [0234.855] SetEvent (hEvent=0x3b0) returned 1 [0234.855] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x460, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0234.857] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0234.857] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0234.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x862d18, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x862d18) returned 0x0 [0234.858] WbemDefPath:IUnknown:AddRef (This=0x862d18) returned 0x3 [0234.858] WbemDefPath:IUnknown:Release (This=0x862d18) returned 0x2 [0234.858] WbemDefPath:IWbemPath:SetText (This=0x862d18, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x0 [0234.858] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0234.858] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0234.858] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.858] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0234.858] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0234.858] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.858] IWbemClassObject:Get (in: This=0x89b980, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231ac5c*=0, plFlavor=0x231ac60*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231ac5c*=11, plFlavor=0x231ac60*=0) returned 0x0 [0234.858] IWbemClassObject:Get (in: This=0x89b980, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231ac5c*=11, plFlavor=0x231ac60*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231ac5c*=11, plFlavor=0x231ac60*=0) returned 0x0 [0234.858] IUnknown:Release (This=0x89b980) returned 0x2 [0234.858] CoTaskMemAlloc (cb=0x4) returned 0x887c88 [0234.858] IEnumWbemClassObject:Next (in: This=0x87e000, lTimeout=-1, uCount=0x1, apObjects=0x887c88, puReturned=0x2319078 | out: apObjects=0x887c88*=0x89ae58, puReturned=0x2319078*=0x1) returned 0x0 [0234.860] IUnknown:QueryInterface (in: This=0x89ae58, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x89ae58) returned 0x0 [0234.861] IUnknown:QueryInterface (in: This=0x89ae58, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0234.861] IUnknown:QueryInterface (in: This=0x89ae58, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0234.861] IUnknown:QueryInterface (in: This=0x89ae58, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0234.862] IUnknown:AddRef (This=0x89ae58) returned 0x3 [0234.862] IUnknown:QueryInterface (in: This=0x89ae58, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0234.862] IUnknown:QueryInterface (in: This=0x89ae58, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0234.862] IUnknown:QueryInterface (in: This=0x89ae58, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x89ae5c) returned 0x0 [0234.862] IMarshal:GetUnmarshalClass (in: This=0x89ae5c, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.862] IUnknown:Release (This=0x89ae5c) returned 0x3 [0234.862] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0234.862] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0234.862] IUnknown:QueryInterface (in: This=0x89ae58, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0234.862] IUnknown:Release (This=0x89ae58) returned 0x2 [0234.862] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0234.862] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0234.862] IUnknown:QueryInterface (in: This=0x89ae58, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x89ae58) returned 0x0 [0234.862] IUnknown:AddRef (This=0x89ae58) returned 0x4 [0234.862] IUnknown:Release (This=0x89ae58) returned 0x3 [0234.862] IUnknown:Release (This=0x89ae58) returned 0x2 [0234.862] CoTaskMemFree (pv=0x887c88) [0234.862] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0234.862] IUnknown:AddRef (This=0x89ae58) returned 0x3 [0234.863] IWbemClassObject:Get (in: This=0x89ae58, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0234.863] IWbemClassObject:Get (in: This=0x89ae58, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0234.863] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x7a [0234.863] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x7a [0234.863] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x464 [0234.863] SetEvent (hEvent=0x3b0) returned 1 [0234.863] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x464, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0234.866] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0234.866] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0234.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x8633a8) returned 0x0 [0234.866] WbemDefPath:IUnknown:AddRef (This=0x8633a8) returned 0x3 [0234.866] WbemDefPath:IUnknown:Release (This=0x8633a8) returned 0x2 [0234.866] WbemDefPath:IWbemPath:SetText (This=0x8633a8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x0 [0234.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0234.866] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0234.866] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0234.866] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0234.866] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.866] IWbemClassObject:Get (in: This=0x89ae58, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231b4d0*=0, plFlavor=0x231b4d4*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231b4d0*=11, plFlavor=0x231b4d4*=0) returned 0x0 [0234.866] IWbemClassObject:Get (in: This=0x89ae58, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231b4d0*=11, plFlavor=0x231b4d4*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231b4d0*=11, plFlavor=0x231b4d4*=0) returned 0x0 [0234.867] IUnknown:Release (This=0x89ae58) returned 0x2 [0234.867] CoTaskMemAlloc (cb=0x4) returned 0x887b78 [0234.867] IEnumWbemClassObject:Next (in: This=0x87e000, lTimeout=-1, uCount=0x1, apObjects=0x887b78, puReturned=0x2319078 | out: apObjects=0x887b78*=0x89bb18, puReturned=0x2319078*=0x1) returned 0x0 [0234.868] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x89bb18) returned 0x0 [0234.868] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0234.868] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0234.868] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0234.868] IUnknown:AddRef (This=0x89bb18) returned 0x3 [0234.868] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0234.868] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0234.868] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x89bb1c) returned 0x0 [0234.868] IMarshal:GetUnmarshalClass (in: This=0x89bb1c, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.868] IUnknown:Release (This=0x89bb1c) returned 0x3 [0234.868] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0234.869] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0234.869] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0234.869] IUnknown:Release (This=0x89bb18) returned 0x2 [0234.869] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0234.869] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0234.869] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x89bb18) returned 0x0 [0234.869] IUnknown:AddRef (This=0x89bb18) returned 0x4 [0234.869] IUnknown:Release (This=0x89bb18) returned 0x3 [0234.869] IUnknown:Release (This=0x89bb18) returned 0x2 [0234.869] CoTaskMemFree (pv=0x887b78) [0234.869] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0234.869] IUnknown:AddRef (This=0x89bb18) returned 0x3 [0234.869] IWbemClassObject:Get (in: This=0x89bb18, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0234.869] IWbemClassObject:Get (in: This=0x89bb18, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0234.869] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x7a [0234.869] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x7a [0234.869] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x468 [0234.870] SetEvent (hEvent=0x3b0) returned 1 [0234.870] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x468, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0234.872] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0234.872] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0234.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x863108, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x863108) returned 0x0 [0234.872] WbemDefPath:IUnknown:AddRef (This=0x863108) returned 0x3 [0234.872] WbemDefPath:IUnknown:Release (This=0x863108) returned 0x2 [0234.872] WbemDefPath:IWbemPath:SetText (This=0x863108, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x0 [0234.872] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0234.872] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0234.872] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.872] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0234.872] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0234.872] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.872] IWbemClassObject:Get (in: This=0x89bb18, wszName="IPEnabled", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231bd44*=0, plFlavor=0x231bd48*=0 | out: pVal=0x19f3e8*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), pType=0x231bd44*=11, plFlavor=0x231bd48*=0) returned 0x0 [0234.872] IWbemClassObject:Get (in: This=0x89bb18, wszName="IPEnabled", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231bd44*=11, plFlavor=0x231bd48*=0 | out: pVal=0x19f3f0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), pType=0x231bd44*=11, plFlavor=0x231bd48*=0) returned 0x0 [0234.875] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f3ec | out: puCount=0x19f3ec*=0x2) returned 0x0 [0234.875] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3e8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3e8*=0xf, pszText=0x0) returned 0x0 [0234.875] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f3e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.875] IWbemClassObject:Get (in: This=0x89bb18, wszName="MacAddress", lFlags=0, pVal=0x19f3e8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231bde0*=0, plFlavor=0x231bde4*=0 | out: pVal=0x19f3e8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="58:BC:27:F7:CC:54", varVal2=0x0), pType=0x231bde0*=8, plFlavor=0x231bde4*=0) returned 0x0 [0234.875] SysStringByteLen (bstr="58:BC:27:F7:CC:54") returned 0x22 [0234.875] SysStringByteLen (bstr="58:BC:27:F7:CC:54") returned 0x22 [0234.876] IWbemClassObject:Get (in: This=0x89bb18, wszName="MacAddress", lFlags=0, pVal=0x19f3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x231bde0*=8, plFlavor=0x231bde4*=0 | out: pVal=0x19f3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="58:BC:27:F7:CC:54", varVal2=0x0), pType=0x231bde0*=8, plFlavor=0x231bde4*=0) returned 0x0 [0234.876] SysStringByteLen (bstr="58:BC:27:F7:CC:54") returned 0x22 [0234.876] SysStringByteLen (bstr="58:BC:27:F7:CC:54") returned 0x22 [0234.876] IUnknown:Release (This=0x89bb18) returned 0x2 [0234.876] CoTaskMemAlloc (cb=0x4) returned 0x887c38 [0234.876] IEnumWbemClassObject:Next (in: This=0x87e000, lTimeout=-1, uCount=0x1, apObjects=0x887c38, puReturned=0x2319078 | out: apObjects=0x887c38*=0x89b320, puReturned=0x2319078*=0x1) returned 0x0 [0234.877] IUnknown:QueryInterface (in: This=0x89b320, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea58 | out: ppvObject=0x19ea58*=0x89b320) returned 0x0 [0234.877] IUnknown:QueryInterface (in: This=0x89b320, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea14 | out: ppvObject=0x19ea14*=0x0) returned 0x80004002 [0234.877] IUnknown:QueryInterface (in: This=0x89b320, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e834 | out: ppvObject=0x19e834*=0x0) returned 0x80004002 [0234.877] IUnknown:QueryInterface (in: This=0x89b320, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0234.878] IUnknown:AddRef (This=0x89b320) returned 0x3 [0234.878] IUnknown:QueryInterface (in: This=0x89b320, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e374 | out: ppvObject=0x19e374*=0x0) returned 0x80004002 [0234.878] IUnknown:QueryInterface (in: This=0x89b320, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0234.878] IUnknown:QueryInterface (in: This=0x89b320, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e330 | out: ppvObject=0x19e330*=0x89b324) returned 0x0 [0234.878] IMarshal:GetUnmarshalClass (in: This=0x89b324, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e338 | out: pCid=0x19e338*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.878] IUnknown:Release (This=0x89b324) returned 0x3 [0234.878] CoGetContextToken (in: pToken=0x19e390 | out: pToken=0x19e390) returned 0x0 [0234.878] CoGetContextToken (in: pToken=0x19e798 | out: pToken=0x19e798) returned 0x0 [0234.878] IUnknown:QueryInterface (in: This=0x89b320, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e828 | out: ppvObject=0x19e828*=0x0) returned 0x80004002 [0234.878] IUnknown:Release (This=0x89b320) returned 0x2 [0234.878] CoGetContextToken (in: pToken=0x19ed68 | out: pToken=0x19ed68) returned 0x0 [0234.878] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0234.878] IUnknown:QueryInterface (in: This=0x89b320, riid=0x19ed98*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ed94 | out: ppvObject=0x19ed94*=0x89b320) returned 0x0 [0234.878] IUnknown:AddRef (This=0x89b320) returned 0x4 [0234.878] IUnknown:Release (This=0x89b320) returned 0x3 [0234.878] IUnknown:Release (This=0x89b320) returned 0x2 [0234.878] CoTaskMemFree (pv=0x887c38) [0234.878] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0234.878] IUnknown:AddRef (This=0x89b320) returned 0x3 [0234.879] IWbemClassObject:Get (in: This=0x89b320, wszName="__GENUS", lFlags=0, pVal=0x19f3e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f464*=0, plFlavor=0x19f460*=0 | out: pVal=0x19f3e4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f464*=3, plFlavor=0x19f460*=64) returned 0x0 [0234.879] IWbemClassObject:Get (in: This=0x89b320, wszName="__PATH", lFlags=0, pVal=0x19f3c8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f44c*=0, plFlavor=0x19f448*=0 | out: pVal=0x19f3c8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5", varVal2=0x0), pType=0x19f44c*=8, plFlavor=0x19f448*=64) returned 0x0 [0234.879] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x7a [0234.879] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x7a [0234.879] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x46c [0234.879] SetEvent (hEvent=0x3b0) returned 1 [0234.879] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3a0*=0x46c, lpdwindex=0x19f1bc | out: lpdwindex=0x19f1bc) returned 0x0 [0234.883] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0 [0234.883] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0234.883] WbemDefPath:IUnknown:QueryInterface (in: This=0x863258, riid=0x19f2a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x863258) returned 0x0 [0234.883] WbemDefPath:IUnknown:AddRef (This=0x863258) returned 0x3 [0234.883] WbemDefPath:IUnknown:Release (This=0x863258) returned 0x2 [0234.883] WbemDefPath:IWbemPath:SetText (This=0x863258, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=5") returned 0x0 [0234.883] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x19f420 | out: puCount=0x19f420*=0x2) returned 0x0 [0234.883] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f41c*=0x0, pszText=0x0 | out: puBuffLength=0x19f41c*=0xf, pszText=0x0) returned 0x0 [0234.883] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=4, puBuffLength=0x19f41c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f41c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.883] CoTaskMemAlloc (cb=0x4) returned 0x887b78 [0234.883] IEnumWbemClassObject:Next (in: This=0x87e000, lTimeout=-1, uCount=0x1, apObjects=0x887b78, puReturned=0x2319078 | out: apObjects=0x887b78*=0x0, puReturned=0x2319078*=0x0) returned 0x1 [0234.884] CoTaskMemFree (pv=0x887b78) [0234.884] CoGetContextToken (in: pToken=0x19f320 | out: pToken=0x19f320) returned 0x0 [0234.884] WbemLocator:IUnknown:Release (This=0x89c408) returned 0x1 [0234.884] IUnknown:Release (This=0x87e000) returned 0x0 [0234.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", nBufferLength=0x105, lpBuffer=0x19ef38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpFilePart=0x0) returned 0x39 [0234.930] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x19f354, nSize=0x80 | out: lpBuffer="") returned 0x25 [0234.942] GetUserNameW (in: lpBuffer=0x19f254, pcbBuffer=0x231d68c | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x231d68c) returned 1 [0234.949] GetComputerNameW (in: lpBuffer=0x19f254, nSize=0x231db08 | out: lpBuffer="XC64ZB", nSize=0x231db08) returned 1 [0235.005] EtwEventRegister (in: ProviderId=0x231e0b0, EnableCallback=0x4730bf6, CallbackContext=0x0, RegHandle=0x231e08c | out: RegHandle=0x231e08c) returned 0x0 [0235.007] EtwEventSetInformation (RegHandle=0x8382e8, InformationClass=0x44, EventInformation=0x2, InformationLength=0x231e050) returned 0x0 [0235.008] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f3f8 | out: UnbiasedTime=0x19f3f8) returned 1 [0235.015] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f3e8 | out: UnbiasedTime=0x19f3e8) returned 1 [0235.017] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f418 | out: UnbiasedTime=0x19f418) returned 1 [0235.017] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f408 | out: UnbiasedTime=0x19f408) returned 1 [0235.025] CoTaskMemAlloc (cb=0x20c) returned 0x8bb2b0 [0235.025] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x8bb2b0 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0235.027] CoTaskMemFree (pv=0x8bb2b0) [0235.027] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x19eefc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0235.031] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\drivers\\etc\\hosts", nBufferLength=0x105, lpBuffer=0x19ee64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\drivers\\etc\\hosts", lpFilePart=0x0) returned 0x25 [0235.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f358) returned 1 [0235.031] CreateFileW (lpFileName="C:\\Windows\\system32\\drivers\\etc\\hosts" (normalized: "c:\\windows\\system32\\drivers\\etc\\hosts"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x488 [0235.032] GetFileType (hFile=0x488) returned 0x1 [0235.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f354) returned 1 [0235.032] GetFileType (hFile=0x488) returned 0x1 [0235.032] SetFilePointer (in: hFile=0x488, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f32c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f32c*=0) returned 0x338 [0235.035] WriteFile (in: hFile=0x488, lpBuffer=0x2320478*, nNumberOfBytesToWrite=0xb, lpNumberOfBytesWritten=0x19f408, lpOverlapped=0x0 | out: lpBuffer=0x2320478*, lpNumberOfBytesWritten=0x19f408*=0xb, lpOverlapped=0x0) returned 1 [0235.037] CloseHandle (hObject=0x488) returned 1 [0235.091] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x19f300, nSize=0x80 | out: lpBuffer="") returned 0x25 [0235.093] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\", nBufferLength=0x105, lpBuffer=0x19ef5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\", lpFilePart=0x0) returned 0x2d [0235.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f3b8) returned 1 [0235.093] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ykvbuy"), fInfoLevelId=0x0, lpFileInformation=0x19f434 | out: lpFileInformation=0x19f434*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0235.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f3b4) returned 1 [0235.094] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x19f300, nSize=0x80 | out: lpBuffer="") returned 0x25 [0235.094] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\", nBufferLength=0x105, lpBuffer=0x19ef60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\", lpFilePart=0x0) returned 0x2d [0235.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f348) returned 1 [0235.094] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ykvbuy"), fInfoLevelId=0x0, lpFileInformation=0x19f3c4 | out: lpFileInformation=0x19f3c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0235.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f344) returned 1 [0235.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f348) returned 1 [0235.095] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ykvbuy"), fInfoLevelId=0x0, lpFileInformation=0x19f3c4 | out: lpFileInformation=0x19f3c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0235.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f344) returned 1 [0235.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f348) returned 1 [0235.095] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0x19f3c4 | out: lpFileInformation=0x19f3c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xde8865d5, ftLastAccessTime.dwHighDateTime=0x1d8598c, ftLastWriteTime.dwLowDateTime=0xde8865d5, ftLastWriteTime.dwHighDateTime=0x1d8598c, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0235.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f344) returned 1 [0235.098] CreateDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ykvbuy"), lpSecurityAttributes=0x0) returned 1 [0235.100] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe", nBufferLength=0x105, lpBuffer=0x19ef64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe", lpFilePart=0x0) returned 0x37 [0235.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f3c4) returned 1 [0235.100] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ykvbuy\\ykvbuy.exe"), fInfoLevelId=0x0, lpFileInformation=0x19f440 | out: lpFileInformation=0x19f440*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0235.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f3c0) returned 1 [0235.100] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", nBufferLength=0x105, lpBuffer=0x19ef64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpFilePart=0x0) returned 0x39 [0235.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f3c4) returned 1 [0235.100] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe"), fInfoLevelId=0x0, lpFileInformation=0x19f440 | out: lpFileInformation=0x19f440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x611edffd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x611edffd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x611edffd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f938)) returned 1 [0235.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f3c0) returned 1 [0235.100] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe", nBufferLength=0x105, lpBuffer=0x19ef64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe", lpFilePart=0x0) returned 0x37 [0235.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f3c4) returned 1 [0235.101] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ykvbuy\\ykvbuy.exe"), fInfoLevelId=0x0, lpFileInformation=0x19f440 | out: lpFileInformation=0x19f440*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0235.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f3c0) returned 1 [0235.101] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", nBufferLength=0x105, lpBuffer=0x19ef14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpFilePart=0x0) returned 0x39 [0235.102] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe", nBufferLength=0x105, lpBuffer=0x19ef14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe", lpFilePart=0x0) returned 0x37 [0235.102] CopyFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ykvbuy\\ykvbuy.exe"), bFailIfExists=0) returned 1 [0236.585] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe", nBufferLength=0x105, lpBuffer=0x19ef74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe", lpFilePart=0x0) returned 0x37 [0236.586] SetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe", dwFileAttributes=0x6) returned 1 [0236.590] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x19f430 | out: phkResult=0x19f430*=0x488) returned 0x0 [0236.595] RegQueryValueExW (in: hKey=0x488, lpValueName="ykVBUY", lpReserved=0x0, lpType=0x19f42c, lpData=0x0, lpcbData=0x19f428*=0x0 | out: lpType=0x19f42c*=0x0, lpData=0x0, lpcbData=0x19f428*=0x0) returned 0x2 [0236.595] RegSetValueExW (in: hKey=0x488, lpValueName="ykVBUY", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe", cbData=0x70 | out: lpData="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe") returned 0x0 [0236.600] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x19f430 | out: phkResult=0x19f430*=0x0) returned 0x2 [0236.603] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe", nBufferLength=0x105, lpBuffer=0x19ef44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe", lpFilePart=0x0) returned 0x37 [0236.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f3a4) returned 1 [0236.603] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ykvbuy\\ykvbuy.exe"), fInfoLevelId=0x0, lpFileInformation=0x19f420 | out: lpFileInformation=0x19f420*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x6247cbc7, ftCreationTime.dwHighDateTime=0x1d85fb9, ftLastAccessTime.dwLowDateTime=0x6247cbc7, ftLastAccessTime.dwHighDateTime=0x1d85fb9, ftLastWriteTime.dwLowDateTime=0x611edffd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f938)) returned 1 [0236.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f3a0) returned 1 [0236.637] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\ykVBUY\\ykVBUY.exe:Zone.Identifier" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\ykvbuy\\ykvbuy.exe:zone.identifier")) returned 0 [0236.767] CoTaskMemAlloc (cb=0x20c) returned 0x8bcc30 [0236.767] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8bcc30 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0236.768] CoTaskMemFree (pv=0x8bcc30) [0236.768] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19ebd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0236.770] CoTaskMemAlloc (cb=0x20c) returned 0x8bcc30 [0236.771] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x8bcc30 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0236.771] CoTaskMemFree (pv=0x8bcc30) [0236.771] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19ebd4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0238.394] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", lpFilePart=0x0) returned 0x35 [0238.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.394] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.395] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", lpFilePart=0x0) returned 0x33 [0238.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.395] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.395] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data", lpFilePart=0x0) returned 0x33 [0238.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.395] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.395] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", lpFilePart=0x0) returned 0x3b [0238.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.396] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.396] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", lpFilePart=0x0) returned 0x36 [0238.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.396] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\qip surf\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.396] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpFilePart=0x0) returned 0x42 [0238.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.396] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\catalinagroup\\citrio\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.397] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpFilePart=0x0) returned 0x49 [0238.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\bravesoftware\\brave-browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.397] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", lpFilePart=0x0) returned 0x35 [0238.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\orbitum\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.397] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", lpFilePart=0x0) returned 0x36 [0238.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.397] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", lpFilePart=0x0) returned 0x3b [0238.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coowon\\coowon\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.398] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Chrome\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Chrome\\Chrome\\User Data", lpFilePart=0x0) returned 0x3e [0238.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Chrome\\Chrome\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\360chrome\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.398] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpFilePart=0x0) returned 0x42 [0238.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex\\yandexbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.398] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", lpFilePart=0x0) returned 0x42 [0238.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.399] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpFilePart=0x0) returned 0x44 [0238.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.399] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maplestudio\\chromeplus\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.399] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", lpFilePart=0x0) returned 0x39 [0238.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.399] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.399] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpFilePart=0x0) returned 0x57 [0238.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.399] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\fenrir inc\\sleipnir5\\setting\\modules\\chromiumviewer"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.400] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", lpFilePart=0x0) returned 0x3c [0238.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.400] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.400] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", lpFilePart=0x0) returned 0x34 [0238.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.400] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\kometa\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.400] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", lpFilePart=0x0) returned 0x39 [0238.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.400] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.401] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable", lpFilePart=0x0) returned 0x41 [0238.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.401] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpFilePart=0x0) returned 0x3d [0238.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\sputnik\\sputnik\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.401] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpFilePart=0x0) returned 0x3c [0238.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucozmedia\\uran\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.401] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", lpFilePart=0x0) returned 0x35 [0238.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\iridium\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.402] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", lpFilePart=0x0) returned 0x34 [0238.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\liebao\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.402] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", lpFilePart=0x0) returned 0x3e [0238.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\elements browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.402] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", lpFilePart=0x0) returned 0x34 [0238.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.416] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0238.416] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0238.416] CoTaskMemFree (pv=0x8c4768) [0238.417] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19ebb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0238.422] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x3c [0238.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f034) returned 1 [0238.422] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0b0 | out: lpFileInformation=0x19f0b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0238.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f030) returned 1 [0238.434] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x19d850, nSize=0x80 | out: lpBuffer="") returned 0x25 [0238.539] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini", lpFilePart=0x0) returned 0x3a [0238.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0238.539] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\postbox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0238.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0238.664] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini", lpFilePart=0x0) returned 0x3a [0238.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0238.664] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Postbox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\postbox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0238.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0238.702] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", lpFilePart=0x0) returned 0x43 [0238.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0238.702] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\comodo\\icedragon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0238.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0238.708] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", lpFilePart=0x0) returned 0x43 [0238.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0238.709] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\comodo\\icedragon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0238.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0238.723] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x42 [0238.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0238.724] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0238.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0238.728] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x42 [0238.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0238.729] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0238.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0238.784] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0238.784] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0238.785] CoTaskMemFree (pv=0x8c4768) [0238.785] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0238.787] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19ec14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3a [0238.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f070) returned 1 [0238.787] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials"), fInfoLevelId=0x0, lpFileInformation=0x19f0ec | out: lpFileInformation=0x19f0ec*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x58717184, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0238.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f06c) returned 1 [0238.787] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0238.787] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0238.787] CoTaskMemFree (pv=0x8c4768) [0238.788] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0238.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f0ec) returned 1 [0238.789] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19ebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3a [0238.791] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19ebc8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3a [0238.791] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\*"), lpFindFileData=0x19ee14 | out: lpFindFileData=0x19ee14*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x58717184, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x86d870 [0238.793] FindNextFileW (in: hFindFile=0x86d870, lpFindFileData=0x19ee24 | out: lpFindFileData=0x19ee24*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x58717184, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.793] FindNextFileW (in: hFindFile=0x86d870, lpFindFileData=0x19ee24 | out: lpFindFileData=0x19ee24*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DFBE70A7E5CC19A398EBF1B96859CE5D", cAlternateFileName="DFBE70~1")) returned 1 [0238.794] FindNextFileW (in: hFindFile=0x86d870, lpFindFileData=0x19ee24 | out: lpFindFileData=0x19ee24*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0238.794] FindClose (in: hFindFile=0x86d870 | out: hFindFile=0x86d870) returned 1 [0238.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0ac) returned 1 [0238.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0b8) returned 1 [0238.798] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0238.798] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0238.798] CoTaskMemFree (pv=0x8c4768) [0238.798] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0238.798] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19ec14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3c [0238.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f070) returned 1 [0238.798] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\credentials"), fInfoLevelId=0x0, lpFileInformation=0x19f0ec | out: lpFileInformation=0x19f0ec*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0238.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f06c) returned 1 [0238.799] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0238.799] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0238.799] CoTaskMemFree (pv=0x8c4768) [0238.799] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0238.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f0ec) returned 1 [0238.799] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19ebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3c [0238.799] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19ebc8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3c [0238.799] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\credentials\\*"), lpFindFileData=0x19ee14 | out: lpFindFileData=0x19ee14*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x86d770 [0238.799] FindNextFileW (in: hFindFile=0x86d770, lpFindFileData=0x19ee24 | out: lpFindFileData=0x19ee24*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.800] FindNextFileW (in: hFindFile=0x86d770, lpFindFileData=0x19ee24 | out: lpFindFileData=0x19ee24*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0238.800] FindClose (in: hFindFile=0x86d770 | out: hFindFile=0x86d770) returned 1 [0238.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0ac) returned 1 [0238.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0b8) returned 1 [0238.853] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19eb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0238.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f02c) returned 1 [0238.853] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), fInfoLevelId=0x0, lpFileInformation=0x2345688 | out: lpFileInformation=0x2345688*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0)) returned 1 [0238.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f028) returned 1 [0238.853] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19ea70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0238.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef64) returned 1 [0238.853] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x4f4 [0238.853] GetFileType (hFile=0x4f4) returned 0x1 [0238.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef60) returned 1 [0238.854] GetFileType (hFile=0x4f4) returned 0x1 [0238.854] GetFileSize (in: hFile=0x4f4, lpFileSizeHigh=0x19f06c | out: lpFileSizeHigh=0x19f06c*=0x0) returned 0x2ac0 [0238.854] ReadFile (in: hFile=0x4f4, lpBuffer=0x2345950, nNumberOfBytesToRead=0x2ac0, lpNumberOfBytesRead=0x19f018, lpOverlapped=0x0 | out: lpBuffer=0x2345950*, lpNumberOfBytesRead=0x19f018*=0x2ac0, lpOverlapped=0x0) returned 1 [0238.855] CloseHandle (hObject=0x4f4) returned 1 [0239.135] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19eb68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0239.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19effc) returned 1 [0239.135] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), fInfoLevelId=0x0, lpFileInformation=0x19f078 | out: lpFileInformation=0x19f078*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0)) returned 1 [0239.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eff8) returned 1 [0239.137] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x19ed44 | out: pTimeZoneInformation=0x19ed44) returned 0x2 [0239.140] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ee28 | out: phkResult=0x19ee28*=0x4f4) returned 0x0 [0239.141] RegQueryValueExW (in: hKey=0x4f4, lpValueName="TZI", lpReserved=0x0, lpType=0x19ee44, lpData=0x0, lpcbData=0x19ee40*=0x0 | out: lpType=0x19ee44*=0x3, lpData=0x0, lpcbData=0x19ee40*=0x2c) returned 0x0 [0239.143] RegQueryValueExW (in: hKey=0x4f4, lpValueName="TZI", lpReserved=0x0, lpType=0x19ee44, lpData=0x234b0a4, lpcbData=0x19ee40*=0x2c | out: lpType=0x19ee44*=0x3, lpData=0x234b0a4*, lpcbData=0x19ee40*=0x2c) returned 0x0 [0239.144] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ec7c | out: phkResult=0x19ec7c*=0x0) returned 0x2 [0239.145] RegQueryValueExW (in: hKey=0x4f4, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19ee1c, lpData=0x0, lpcbData=0x19ee18*=0x0 | out: lpType=0x19ee1c*=0x1, lpData=0x0, lpcbData=0x19ee18*=0x20) returned 0x0 [0239.145] RegQueryValueExW (in: hKey=0x4f4, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19ee1c, lpData=0x234b4c8, lpcbData=0x19ee18*=0x20 | out: lpType=0x19ee1c*=0x1, lpData="@tzres.dll,-320", lpcbData=0x19ee18*=0x20) returned 0x0 [0239.145] RegQueryValueExW (in: hKey=0x4f4, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19ee1c, lpData=0x0, lpcbData=0x19ee18*=0x0 | out: lpType=0x19ee1c*=0x1, lpData=0x0, lpcbData=0x19ee18*=0x20) returned 0x0 [0239.145] RegQueryValueExW (in: hKey=0x4f4, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19ee1c, lpData=0x234b520, lpcbData=0x19ee18*=0x20 | out: lpType=0x19ee1c*=0x1, lpData="@tzres.dll,-322", lpcbData=0x19ee18*=0x20) returned 0x0 [0239.145] RegQueryValueExW (in: hKey=0x4f4, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19ee1c, lpData=0x0, lpcbData=0x19ee18*=0x0 | out: lpType=0x19ee1c*=0x1, lpData=0x0, lpcbData=0x19ee18*=0x20) returned 0x0 [0239.145] RegQueryValueExW (in: hKey=0x4f4, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19ee1c, lpData=0x234b578, lpcbData=0x19ee18*=0x20 | out: lpType=0x19ee1c*=0x1, lpData="@tzres.dll,-321", lpcbData=0x19ee18*=0x20) returned 0x0 [0239.147] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0239.147] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0239.147] CoTaskMemFree (pv=0x8c4768) [0239.147] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0239.147] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19ee38, pwszFileMUIPath=0x8c4768, pcchFileMUIPath=0x19ee3c, pululEnumerator=0x19ee30 | out: pwszLanguage=0x0, pcchLanguage=0x19ee38, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19ee3c, pululEnumerator=0x19ee30) returned 1 [0239.166] CoTaskMemFree (pv=0x0) [0239.166] CoTaskMemFree (pv=0x8c4768) [0239.166] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5150001 [0239.191] CoTaskMemAlloc (cb=0x3ec) returned 0x51dc080 [0239.191] LoadStringW (in: hInstance=0x5150001, uID=0x140, lpBuffer=0x51dc080, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0239.192] CoTaskMemFree (pv=0x51dc080) [0239.192] FreeLibrary (hLibModule=0x5150001) returned 1 [0239.194] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0239.194] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0239.194] CoTaskMemFree (pv=0x8c4768) [0239.194] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0239.194] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19ee38, pwszFileMUIPath=0x8c4768, pcchFileMUIPath=0x19ee3c, pululEnumerator=0x19ee30 | out: pwszLanguage=0x0, pcchLanguage=0x19ee38, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19ee3c, pululEnumerator=0x19ee30) returned 1 [0239.199] CoTaskMemFree (pv=0x0) [0239.199] CoTaskMemFree (pv=0x8c4768) [0239.199] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5150001 [0239.202] CoTaskMemAlloc (cb=0x3ec) returned 0x51dc080 [0239.202] LoadStringW (in: hInstance=0x5150001, uID=0x142, lpBuffer=0x51dc080, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0239.202] CoTaskMemFree (pv=0x51dc080) [0239.202] FreeLibrary (hLibModule=0x5150001) returned 1 [0239.203] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0239.203] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0239.203] CoTaskMemFree (pv=0x8c4768) [0239.203] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0239.203] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19ee38, pwszFileMUIPath=0x8c4768, pcchFileMUIPath=0x19ee3c, pululEnumerator=0x19ee30 | out: pwszLanguage=0x0, pcchLanguage=0x19ee38, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19ee3c, pululEnumerator=0x19ee30) returned 1 [0239.206] CoTaskMemFree (pv=0x0) [0239.206] CoTaskMemFree (pv=0x8c4768) [0239.206] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5150001 [0239.209] CoTaskMemAlloc (cb=0x3ec) returned 0x51dc080 [0239.210] LoadStringW (in: hInstance=0x5150001, uID=0x141, lpBuffer=0x51dc080, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0239.210] CoTaskMemFree (pv=0x51dc080) [0239.210] FreeLibrary (hLibModule=0x5150001) returned 1 [0239.211] RegCloseKey (hKey=0x4f4) returned 0x0 [0239.212] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19eb68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0239.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19effc) returned 1 [0239.212] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), fInfoLevelId=0x0, lpFileInformation=0x19f078 | out: lpFileInformation=0x19f078*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58717184, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x5871986a, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0)) returned 1 [0239.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eff8) returned 1 [0239.250] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0239.250] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0239.250] CoTaskMemFree (pv=0x8c4768) [0239.250] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0239.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f0ec) returned 1 [0239.253] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x19ebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x38 [0239.253] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x19ebc8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x38 [0239.253] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\protect\\*"), lpFindFileData=0x19ee14 | out: lpFindFileData=0x19ee14*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50866c1c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x86d770 [0239.254] FindNextFileW (in: hFindFile=0x86d770, lpFindFileData=0x19ee24 | out: lpFindFileData=0x19ee24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50866c1c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.254] FindNextFileW (in: hFindFile=0x86d770, lpFindFileData=0x19ee24 | out: lpFindFileData=0x19ee24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xcf68faea, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0239.254] FindNextFileW (in: hFindFile=0x86d770, lpFindFileData=0x19ee24 | out: lpFindFileData=0x19ee24*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x50866c1c, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x562658a2, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x562658a2, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0239.254] FindNextFileW (in: hFindFile=0x86d770, lpFindFileData=0x19ee24 | out: lpFindFileData=0x19ee24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xcf753085, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0239.254] FindNextFileW (in: hFindFile=0x86d770, lpFindFileData=0x19ee24 | out: lpFindFileData=0x19ee24*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xcf753085, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 0 [0239.255] FindClose (in: hFindFile=0x86d770 | out: hFindFile=0x86d770) returned 1 [0239.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0ac) returned 1 [0239.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0b8) returned 1 [0239.271] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", nBufferLength=0x105, lpBuffer=0x19ec1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", lpFilePart=0x0) returned 0x8b [0239.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f07c) returned 1 [0239.271] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1"), fInfoLevelId=0x0, lpFileInformation=0x19f0f8 | out: lpFileInformation=0x19f0f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x562658a2, ftCreationTime.dwHighDateTime=0x1d82a22, ftLastAccessTime.dwLowDateTime=0x562658a2, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0xcf6b6c82, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x1d4)) returned 1 [0239.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f078) returned 1 [0239.272] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", lpFilePart=0x0) returned 0x8b [0239.272] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", lpFilePart=0x0) returned 0x8b [0239.272] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000", nBufferLength=0x105, lpBuffer=0x19ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000", lpFilePart=0x0) returned 0x66 [0239.272] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\.", nBufferLength=0x105, lpBuffer=0x19eb98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000", lpFilePart=0x0) returned 0x66 [0239.527] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", nBufferLength=0x105, lpBuffer=0x19eb08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1", lpFilePart=0x0) returned 0x8b [0239.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19effc) returned 1 [0239.528] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1560258661-3990802383-1811730007-1000\\26d4f968-a540-431b-ab1b-a50e9bbda5d1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x4f4 [0239.528] GetFileType (hFile=0x4f4) returned 0x1 [0239.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eff8) returned 1 [0239.528] GetFileType (hFile=0x4f4) returned 0x1 [0239.528] GetFileSize (in: hFile=0x4f4, lpFileSizeHigh=0x19f104 | out: lpFileSizeHigh=0x19f104*=0x0) returned 0x1d4 [0239.528] ReadFile (in: hFile=0x4f4, lpBuffer=0x2354dd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f0b0, lpOverlapped=0x0 | out: lpBuffer=0x2354dd0*, lpNumberOfBytesRead=0x19f0b0*=0x1d4, lpOverlapped=0x0) returned 1 [0239.529] CloseHandle (hObject=0x4f4) returned 1 [0240.679] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", nBufferLength=0x105, lpBuffer=0x19eb08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D", lpFilePart=0x0) returned 0x5a [0240.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19effc) returned 1 [0240.679] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\dfbe70a7e5cc19a398ebf1b96859ce5d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x4a8 [0240.679] GetFileType (hFile=0x4a8) returned 0x1 [0240.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eff8) returned 1 [0240.679] GetFileType (hFile=0x4a8) returned 0x1 [0240.679] GetFileSize (in: hFile=0x4a8, lpFileSizeHigh=0x19f104 | out: lpFileSizeHigh=0x19f104*=0x0) returned 0x2ac0 [0240.680] ReadFile (in: hFile=0x4a8, lpBuffer=0x2342900, nNumberOfBytesToRead=0x2ac0, lpNumberOfBytesRead=0x19f0b0, lpOverlapped=0x0 | out: lpBuffer=0x2342900*, lpNumberOfBytesRead=0x19f0b0*=0x2ac0, lpOverlapped=0x0) returned 1 [0240.680] CloseHandle (hObject=0x4a8) returned 1 [0240.901] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0240.901] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0240.901] CoTaskMemFree (pv=0x8c4768) [0240.901] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0240.904] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0240.904] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0240.904] CoTaskMemFree (pv=0x8c4768) [0240.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0240.906] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\eM Client", nBufferLength=0x105, lpBuffer=0x19ec28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\eM Client", lpFilePart=0x0) returned 0x2f [0240.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f084) returned 1 [0240.906] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\eM Client" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\em client"), fInfoLevelId=0x0, lpFileInformation=0x19f100 | out: lpFileInformation=0x19f100*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0240.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f080) returned 1 [0240.937] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0240.937] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x8c4768, nSize=0x104 | out: lpBuffer="") returned 0x25 [0240.937] CoTaskMemFree (pv=0x8c4768) [0240.940] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\The Bat!", nBufferLength=0x105, lpBuffer=0x19ec14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\The Bat!", lpFilePart=0x0) returned 0x2e [0240.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f070) returned 1 [0240.941] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\The Bat!" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\the bat!"), fInfoLevelId=0x0, lpFileInformation=0x19f0ec | out: lpFileInformation=0x19f0ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0240.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f06c) returned 1 [0240.965] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0240.965] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0240.965] CoTaskMemFree (pv=0x8c4768) [0240.965] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eb5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0240.971] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\falkon\\profiles\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\falkon\\profiles\\profiles.ini", lpFilePart=0x0) returned 0x40 [0240.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efa4) returned 1 [0240.971] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\falkon\\profiles\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\falkon\\profiles\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0240.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d680) returned 1 [0241.248] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Aerofox\\FoxmailPreview", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef84 | out: phkResult=0x19ef84*=0x0) returned 0x2 [0241.252] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Aerofox\\Foxmail\\V3.1", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef84 | out: phkResult=0x19ef84*=0x0) returned 0x2 [0241.254] GetFullPathNameW (in: lpFileName="\\Storage\\", nBufferLength=0x105, lpBuffer=0x19eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Storage\\", lpFilePart=0x0) returned 0xb [0241.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef4c) returned 1 [0241.260] GetFileAttributesExW (in: lpFileName="C:\\Storage\\" (normalized: "c:\\storage"), fInfoLevelId=0x0, lpFileInformation=0x19efc8 | out: lpFileInformation=0x19efc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0241.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef48) returned 1 [0241.267] GetFullPathNameW (in: lpFileName="\\mail\\", nBufferLength=0x105, lpBuffer=0x19eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\mail\\", lpFilePart=0x0) returned 0x8 [0241.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef4c) returned 1 [0241.267] GetFileAttributesExW (in: lpFileName="C:\\mail\\" (normalized: "c:\\mail"), fInfoLevelId=0x0, lpFileInformation=0x19efc8 | out: lpFileInformation=0x19efc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0241.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef48) returned 1 [0241.267] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0241.267] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0241.268] CoTaskMemFree (pv=0x8c4768) [0241.268] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0241.270] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\", nBufferLength=0x105, lpBuffer=0x19eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\", lpFilePart=0x0) returned 0x4c [0241.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef4c) returned 1 [0241.270] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\virtualstore\\program files\\foxmail\\mail"), fInfoLevelId=0x0, lpFileInformation=0x19efc8 | out: lpFileInformation=0x19efc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0241.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef48) returned 1 [0241.280] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0241.280] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0241.280] CoTaskMemFree (pv=0x8c4768) [0241.280] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19ea60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0241.284] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\", nBufferLength=0x105, lpBuffer=0x19eaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\", lpFilePart=0x0) returned 0x52 [0241.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef4c) returned 1 [0241.284] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\virtualstore\\program files (x86)\\foxmail\\mail"), fInfoLevelId=0x0, lpFileInformation=0x19efc8 | out: lpFileInformation=0x19efc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0241.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ef48) returned 1 [0241.346] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0241.346] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x8c4768, nSize=0x104 | out: lpBuffer="") returned 0x25 [0241.346] CoTaskMemFree (pv=0x8c4768) [0241.349] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0241.349] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x8c4768, nSize=0x104 | out: lpBuffer="") returned 0x25 [0241.349] CoTaskMemFree (pv=0x8c4768) [0241.351] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi\\profiles", nBufferLength=0x105, lpBuffer=0x19ebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi\\profiles", lpFilePart=0x0) returned 0x32 [0241.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f058) returned 1 [0241.351] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi\\profiles" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\psi\\profiles"), fInfoLevelId=0x0, lpFileInformation=0x19f0d4 | out: lpFileInformation=0x19f0d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0241.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f054) returned 1 [0241.351] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi+\\profiles", nBufferLength=0x105, lpBuffer=0x19ebfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi+\\profiles", lpFilePart=0x0) returned 0x33 [0241.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f058) returned 1 [0241.351] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Psi+\\profiles" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\psi+\\profiles"), fInfoLevelId=0x0, lpFileInformation=0x19f0d4 | out: lpFileInformation=0x19f0d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0241.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f054) returned 1 [0241.368] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0241.369] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0241.369] CoTaskMemFree (pv=0x8c4768) [0241.369] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eba0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0241.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f104) returned 1 [0241.372] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", nBufferLength=0x105, lpBuffer=0x19ec0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", lpFilePart=0x0) returned 0x2e [0241.372] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", lpFilePart=0x0) returned 0x2e [0241.372] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucbrowser\\*"), lpFindFileData=0x19ee2c | out: lpFindFileData=0x19ee2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0241.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0c8) returned 1 [0241.420] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\IncrediMail\\Identities", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f0dc | out: phkResult=0x19f0dc*=0x0) returned 0x2 [0241.432] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", lpFilePart=0x0) returned 0x3e [0241.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0241.432] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0241.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0241.437] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", lpFilePart=0x0) returned 0x3e [0241.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0241.437] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0241.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0241.483] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0241.483] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x8c4768, nSize=0x104 | out: lpBuffer="") returned 0x25 [0241.483] CoTaskMemFree (pv=0x8c4768) [0241.486] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Pocomail\\accounts.ini", nBufferLength=0x105, lpBuffer=0x19ebf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Pocomail\\accounts.ini", lpFilePart=0x0) returned 0x3b [0241.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f058) returned 1 [0241.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Pocomail\\accounts.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\pocomail\\accounts.ini"), fInfoLevelId=0x0, lpFileInformation=0x19f0d4 | out: lpFileInformation=0x19f0d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0241.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f054) returned 1 [0241.513] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0241.513] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0241.513] CoTaskMemFree (pv=0x8c4768) [0241.513] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0241.517] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat", nBufferLength=0x105, lpBuffer=0x19ec20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat", lpFilePart=0x0) returned 0x44 [0241.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f080) returned 1 [0241.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera mail\\opera mail\\wand.dat"), fInfoLevelId=0x0, lpFileInformation=0x19f0fc | out: lpFileInformation=0x19f0fc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0241.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f07c) returned 1 [0241.559] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Qualcomm\\Eudora\\CommandLine", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f0cc | out: phkResult=0x19f0cc*=0x0) returned 0x2 [0241.614] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0241.614] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0241.615] CoTaskMemFree (pv=0x8c4768) [0241.615] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19ebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0241.618] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db", nBufferLength=0x105, lpBuffer=0x19ec60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db", lpFilePart=0x0) returned 0x3b [0241.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f0c0) returned 1 [0241.618] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\mailbird\\store\\store.db"), fInfoLevelId=0x0, lpFileInformation=0x19f13c | out: lpFileInformation=0x19f13c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0241.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0bc) returned 1 [0241.664] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Flock\\Browser\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Flock\\Browser\\profiles.ini", lpFilePart=0x0) returned 0x40 [0241.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef94) returned 1 [0241.664] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Flock\\Browser\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\flock\\browser\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0241.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d670) returned 1 [0241.824] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0241.825] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0241.825] CoTaskMemFree (pv=0x8c4768) [0241.825] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eb88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0241.832] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19ec1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data", lpFilePart=0x0) returned 0x3f [0241.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f078) returned 1 [0241.832] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tencent\\qqbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19f0f4 | out: lpFileInformation=0x19f0f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0241.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f074) returned 1 [0241.832] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage", nBufferLength=0x105, lpBuffer=0x19ec24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage", lpFilePart=0x0) returned 0x58 [0241.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f084) returned 1 [0241.832] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tencent\\qqbrowser\\user data\\default\\encryptedstorage"), fInfoLevelId=0x0, lpFileInformation=0x19f100 | out: lpFileInformation=0x19f100*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0241.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f080) returned 1 [0241.856] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0241.856] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0241.856] CoTaskMemFree (pv=0x8c4768) [0241.856] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0241.861] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat", nBufferLength=0x105, lpBuffer=0x19ec20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat", lpFilePart=0x0) returned 0x48 [0241.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f080) returned 1 [0241.861] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\trillian\\users\\global\\accounts.dat"), fInfoLevelId=0x0, lpFileInformation=0x19f0fc | out: lpFileInformation=0x19f0fc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0241.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f07c) returned 1 [0241.984] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0241.984] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0241.985] CoTaskMemFree (pv=0x8c4768) [0241.985] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19e9b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0241.988] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", nBufferLength=0x105, lpBuffer=0x19ea30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", lpFilePart=0x0) returned 0x3c [0241.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee8c) returned 1 [0241.988] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data"), fInfoLevelId=0x0, lpFileInformation=0x19ef08 | out: lpFileInformation=0x19ef08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0241.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1 [0242.378] VaultEnumerateVaults () returned 0x0 [0242.436] VaultOpenVault () returned 0x0 [0242.493] VaultEnumerateItems () returned 0x0 [0242.494] VaultOpenVault () returned 0x0 [0242.495] VaultEnumerateItems () returned 0x0 [0242.515] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0242.515] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0242.515] CoTaskMemFree (pv=0x8c4768) [0242.515] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19eb8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0242.518] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPN", nBufferLength=0x105, lpBuffer=0x19ec20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPN", lpFilePart=0x0) returned 0x2b [0242.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f0bc) returned 1 [0242.518] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPN" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nordvpn"), fInfoLevelId=0x0, lpFileInformation=0x235a9ac | out: lpFileInformation=0x235a9ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0242.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0b8) returned 1 [0242.522] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0242.534] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", lpFilePart=0x0) returned 0x48 [0242.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.534] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.539] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", lpFilePart=0x0) returned 0x48 [0242.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.539] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.571] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\OpenVPN-GUI\\configs", ulOptions=0x0, samDesired=0x2001f, phkResult=0x19f100 | out: phkResult=0x19f100*=0x0) returned 0x2 [0242.611] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f0b4 | out: phkResult=0x19f0b4*=0x0) returned 0x2 [0242.612] GetFullPathNameW (in: lpFileName="Folder.lst", nBufferLength=0x105, lpBuffer=0x19ec20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Folder.lst", lpFilePart=0x0) returned 0x28 [0242.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f080) returned 1 [0242.612] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Folder.lst" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\folder.lst"), fInfoLevelId=0x0, lpFileInformation=0x19f0fc | out: lpFileInformation=0x19f0fc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0242.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f07c) returned 1 [0242.622] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0242.622] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0242.624] CoTaskMemFree (pv=0x8c4768) [0242.624] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x19ebac, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0242.627] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0242.627] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0242.627] CoTaskMemFree (pv=0x8c4768) [0242.627] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19ebac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0242.644] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe", nBufferLength=0x105, lpBuffer=0x19ec18, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe", lpFilePart=0x0) returned 0x4e [0242.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f078) returned 1 [0242.644] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe" (normalized: "c:\\program files (x86)\\common files\\apple\\apple application support\\plutil.exe"), fInfoLevelId=0x0, lpFileInformation=0x19f0f4 | out: lpFileInformation=0x19f0f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0242.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f074) returned 1 [0242.660] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", lpFilePart=0x0) returned 0x51 [0242.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.660] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\netgate technologies\\blackhawk\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.665] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", lpFilePart=0x0) returned 0x51 [0242.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.665] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\netgate technologies\\blackhawk\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.678] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini", lpFilePart=0x0) returned 0x3b [0242.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.678] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\waterfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.683] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini", lpFilePart=0x0) returned 0x3b [0242.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.683] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\waterfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.698] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini", lpFilePart=0x0) returned 0x3b [0242.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.698] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\k-meleon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.704] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini", lpFilePart=0x0) returned 0x3b [0242.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.704] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\k-meleon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.717] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", lpFilePart=0x0) returned 0x52 [0242.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.717] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\moonchild productions\\pale moon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.721] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", lpFilePart=0x0) returned 0x52 [0242.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.722] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\moonchild productions\\pale moon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.834] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0242.834] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0242.835] CoTaskMemFree (pv=0x8c4768) [0242.835] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eac4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0242.839] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail", nBufferLength=0x105, lpBuffer=0x19eb58, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail", lpFilePart=0x0) returned 0x30 [0242.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efb4) returned 1 [0242.839] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\claws-mail"), fInfoLevelId=0x0, lpFileInformation=0x19f030 | out: lpFileInformation=0x19f030*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0242.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efb0) returned 1 [0242.844] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail\\clawsrc", nBufferLength=0x105, lpBuffer=0x19eb60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail\\clawsrc", lpFilePart=0x0) returned 0x38 [0242.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.844] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Claws-mail\\clawsrc" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\claws-mail\\clawsrc"), fInfoLevelId=0x0, lpFileInformation=0x19f03c | out: lpFileInformation=0x19f03c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0242.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19efbc) returned 1 [0242.867] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", lpFilePart=0x0) returned 0x41 [0242.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.867] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\icecat\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.873] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", lpFilePart=0x0) returned 0x41 [0242.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.873] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\icecat\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.895] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", lpFilePart=0x0) returned 0x44 [0242.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.895] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\seamonkey\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.899] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", nBufferLength=0x105, lpBuffer=0x19eacc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", lpFilePart=0x0) returned 0x44 [0242.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19efc0) returned 1 [0242.900] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\seamonkey\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0242.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19d698) returned 1 [0242.929] CoTaskMemAlloc (cb=0x20c) returned 0x8c4768 [0242.929] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x8c4768 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0242.930] CoTaskMemFree (pv=0x8c4768) [0242.930] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19eb9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0242.931] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MySQL\\Workbench\\workbench_user_data.dat", nBufferLength=0x105, lpBuffer=0x19ec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MySQL\\Workbench\\workbench_user_data.dat", lpFilePart=0x0) returned 0x4d [0242.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f098) returned 1 [0242.932] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\MySQL\\Workbench\\workbench_user_data.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mysql\\workbench\\workbench_user_data.dat"), fInfoLevelId=0x0, lpFileInformation=0x19f114 | out: lpFileInformation=0x19f114*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0242.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f094) returned 1 [0242.979] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f090 | out: phkResult=0x19f090*=0x0) returned 0x2 [0242.984] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f090 | out: phkResult=0x19f090*=0x0) returned 0x2 [0242.987] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f090 | out: phkResult=0x19f090*=0x0) returned 0x2 [0242.990] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f090 | out: phkResult=0x19f090*=0x508) returned 0x0 [0242.993] RegQueryInfoKeyW (in: hKey=0x508, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x19f0b8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19f0b4, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x19f0b8*=0x3, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19f0b4*=0x6, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0242.993] RegEnumKeyExW (in: hKey=0x508, dwIndex=0x0, lpName=0x237027c, lpcchName=0x19f0d4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000001", lpcchName=0x19f0d4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0242.993] RegEnumKeyExW (in: hKey=0x508, dwIndex=0x1, lpName=0x237027c, lpcchName=0x19f0d4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000002", lpcchName=0x19f0d4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0242.993] RegEnumKeyExW (in: hKey=0x508, dwIndex=0x2, lpName=0x237027c, lpcchName=0x19f0d4, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000003", lpcchName=0x19f0d4, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0242.995] RegOpenKeyExW (in: hKey=0x508, lpSubKey="00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f090 | out: phkResult=0x19f090*=0x50c) returned 0x0 [0242.997] RegQueryValueExW (in: hKey=0x50c, lpValueName="Email", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0242.998] RegQueryValueExW (in: hKey=0x50c, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0242.999] RegQueryValueExW (in: hKey=0x50c, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.000] RegQueryValueExW (in: hKey=0x50c, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.001] RegQueryValueExW (in: hKey=0x50c, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.001] RegCloseKey (hKey=0x50c) returned 0x0 [0243.001] RegOpenKeyExW (in: hKey=0x508, lpSubKey="00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f090 | out: phkResult=0x19f090*=0x50c) returned 0x0 [0243.001] RegQueryValueExW (in: hKey=0x50c, lpValueName="Email", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x1, lpData=0x0, lpcbData=0x19f0ac*=0x1e) returned 0x0 [0243.001] RegQueryValueExW (in: hKey=0x50c, lpValueName="Email", lpReserved=0x0, lpType=0x19f0b0, lpData=0x2370870, lpcbData=0x19f0ac*=0x1e | out: lpType=0x19f0b0*=0x1, lpData="achoo@gdllo.de", lpcbData=0x19f0ac*=0x1e) returned 0x0 [0243.002] RegQueryValueExW (in: hKey=0x50c, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.002] RegQueryValueExW (in: hKey=0x50c, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x3, lpData=0x0, lpcbData=0x19f0ac*=0x121) returned 0x0 [0243.002] RegQueryValueExW (in: hKey=0x50c, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x23708c8, lpcbData=0x19f0ac*=0x121 | out: lpType=0x19f0b0*=0x3, lpData=0x23708c8*, lpcbData=0x19f0ac*=0x121) returned 0x0 [0243.002] RegQueryValueExW (in: hKey=0x50c, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.002] RegQueryValueExW (in: hKey=0x50c, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.002] RegQueryValueExW (in: hKey=0x50c, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.002] RegQueryValueExW (in: hKey=0x50c, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x3, lpData=0x0, lpcbData=0x19f0ac*=0x121) returned 0x0 [0243.002] RegQueryValueExW (in: hKey=0x50c, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x2370a2c, lpcbData=0x19f0ac*=0x121 | out: lpType=0x19f0b0*=0x3, lpData=0x2370a2c*, lpcbData=0x19f0ac*=0x121) returned 0x0 [0243.002] RegQueryValueExW (in: hKey=0x50c, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x3, lpData=0x0, lpcbData=0x19f0ac*=0x121) returned 0x0 [0243.002] RegQueryValueExW (in: hKey=0x50c, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x2370b5c, lpcbData=0x19f0ac*=0x121 | out: lpType=0x19f0b0*=0x3, lpData=0x2370b5c*, lpcbData=0x19f0ac*=0x121) returned 0x0 [0243.763] CryptUnprotectData (in: pDataIn=0x19f098, ppszDataDescr=0x0, pOptionalEntropy=0x19f090, pvReserved=0x0, pPromptStruct=0x0, dwFlags=0x1, pDataOut=0x19f0a0 | out: ppszDataDescr=0x0, pDataOut=0x19f0a0) returned 1 [0243.784] LocalFree (hMem=0x86d770) returned 0x0 [0243.785] RegQueryValueExW (in: hKey=0x50c, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.785] RegQueryValueExW (in: hKey=0x50c, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.785] RegQueryValueExW (in: hKey=0x50c, lpValueName="Email", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x1, lpData=0x0, lpcbData=0x19f0ac*=0x1e) returned 0x0 [0243.785] RegQueryValueExW (in: hKey=0x50c, lpValueName="Email", lpReserved=0x0, lpType=0x19f0b0, lpData=0x2370e8c, lpcbData=0x19f0ac*=0x1e | out: lpType=0x19f0b0*=0x1, lpData="achoo@gdllo.de", lpcbData=0x19f0ac*=0x1e) returned 0x0 [0243.789] RegQueryValueExW (in: hKey=0x50c, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x1, lpData=0x0, lpcbData=0x19f0ac*=0x1c) returned 0x0 [0243.789] RegQueryValueExW (in: hKey=0x50c, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x19f0b0, lpData=0x2370f08, lpcbData=0x19f0ac*=0x1c | out: lpType=0x19f0b0*=0x1, lpData="smtp.gdllo.de", lpcbData=0x19f0ac*=0x1c) returned 0x0 [0243.789] RegQueryValueExW (in: hKey=0x50c, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x1, lpData=0x0, lpcbData=0x19f0ac*=0x1c) returned 0x0 [0243.789] RegQueryValueExW (in: hKey=0x50c, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x19f0b0, lpData=0x2370f58, lpcbData=0x19f0ac*=0x1c | out: lpType=0x19f0b0*=0x1, lpData="smtp.gdllo.de", lpcbData=0x19f0ac*=0x1c) returned 0x0 [0243.799] RegCloseKey (hKey=0x50c) returned 0x0 [0243.799] RegOpenKeyExW (in: hKey=0x508, lpSubKey="00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f090 | out: phkResult=0x19f090*=0x50c) returned 0x0 [0243.799] RegQueryValueExW (in: hKey=0x50c, lpValueName="Email", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.799] RegQueryValueExW (in: hKey=0x50c, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.799] RegQueryValueExW (in: hKey=0x50c, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.799] RegQueryValueExW (in: hKey=0x50c, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.799] RegQueryValueExW (in: hKey=0x50c, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x19f0b0, lpData=0x0, lpcbData=0x19f0ac*=0x0 | out: lpType=0x19f0b0*=0x0, lpData=0x0, lpcbData=0x19f0ac*=0x0) returned 0x2 [0243.799] RegCloseKey (hKey=0x50c) returned 0x0 [0243.861] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19f228 | out: lpTimeZoneInformation=0x19f228) returned 0x2 [0243.904] GetUserNameW (in: lpBuffer=0x19f1a4, pcbBuffer=0x2374be0 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x2374be0) returned 1 [0243.918] GetComputerNameW (in: lpBuffer=0x19f1a4, nSize=0x2375078 | out: lpBuffer="XC64ZB", nSize=0x2375078) returned 1 [0243.952] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x50c [0243.954] SetEvent (hEvent=0x3b0) returned 1 [0243.955] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f324*=0x50c, lpdwindex=0x19f144 | out: lpdwindex=0x19f144) returned 0x0 [0243.957] CoGetContextToken (in: pToken=0x19e15c | out: pToken=0x19e15c) returned 0x0 [0243.957] CoGetContextToken (in: pToken=0x19e144 | out: pToken=0x19e144) returned 0x0 [0243.957] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.957] IUnknown:Release (This=0x81fb48) returned 0x1 [0243.957] IUnknown:Release (This=0x81fb48) returned 0x0 [0243.957] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.957] IUnknown:Release (This=0x85d7f0) returned 0x1 [0243.957] IUnknown:Release (This=0x85d7f0) returned 0x0 [0243.958] IUnknown:Release (This=0x825c08) returned 0x3 [0243.958] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.958] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.958] IUnknown:Release (This=0x874d60) returned 0x1 [0243.958] IUnknown:Release (This=0x874d60) returned 0x0 [0243.969] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.969] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.969] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.969] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.969] IUnknown:Release (This=0x874148) returned 0x0 [0243.969] IUnknown:Release (This=0x8741a0) returned 0x0 [0243.969] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.969] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.969] WbemLocator:IUnknown:Release (This=0x8228c0) returned 0x2 [0243.969] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.969] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.969] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.969] IUnknown:Release (This=0x874098) returned 0x0 [0243.969] IUnknown:Release (This=0x87406c) returned 0x0 [0243.970] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.970] IUnknown:Release (This=0x87e640) returned 0x1 [0243.970] IUnknown:Release (This=0x87e640) returned 0x0 [0243.977] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.977] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.977] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.977] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.977] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.977] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.977] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.977] IUnknown:Release (This=0x83ac98) returned 0x1 [0243.977] WbemLocator:IUnknown:Release (This=0x8228c0) returned 0x1 [0243.977] WbemLocator:IUnknown:Release (This=0x8228c0) returned 0x0 [0243.979] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.979] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.979] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.979] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.979] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.979] IUnknown:Release (This=0x83ac98) returned 0x0 [0243.979] IUnknown:Release (This=0x8741f8) returned 0x0 [0243.979] IUnknown:Release (This=0x8741cc) returned 0x0 [0243.981] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.981] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.981] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.981] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.981] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0243.981] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.981] WbemLocator:IUnknown:Release (This=0x834940) returned 0x1 [0243.981] WbemLocator:IUnknown:Release (This=0x804790) returned 0x0 [0243.982] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.982] IUnknown:Release (This=0x89b7e8) returned 0x2 [0243.982] IUnknown:Release (This=0x89b7e8) returned 0x1 [0243.982] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.982] WbemLocator:IUnknown:Release (This=0x835840) returned 0x1 [0243.982] WbemLocator:IUnknown:Release (This=0x8a42b8) returned 0x0 [0243.983] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.983] IUnknown:Release (This=0x89b650) returned 0x1 [0243.983] IUnknown:Release (This=0x89b650) returned 0x0 [0243.983] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.983] IUnknown:Release (This=0x89b188) returned 0x1 [0243.983] IUnknown:Release (This=0x89b188) returned 0x0 [0243.983] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.983] IUnknown:Release (This=0x89b980) returned 0x1 [0243.983] IUnknown:Release (This=0x89b980) returned 0x0 [0243.983] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.983] IUnknown:Release (This=0x89ae58) returned 0x1 [0243.984] IUnknown:Release (This=0x89ae58) returned 0x0 [0243.984] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.984] IUnknown:Release (This=0x89bb18) returned 0x1 [0243.984] IUnknown:Release (This=0x89bb18) returned 0x0 [0243.984] CoGetContextToken (in: pToken=0x19e0d0 | out: pToken=0x19e0d0) returned 0x0 [0243.984] IUnknown:Release (This=0x89b320) returned 0x2 [0243.984] IUnknown:Release (This=0x89b320) returned 0x1 [0243.992] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0 [0243.992] CoGetContextToken (in: pToken=0x19f150 | out: pToken=0x19f150) returned 0x0 [0243.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x8632c8, riid=0x19f220*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f21c | out: ppvObject=0x19f21c*=0x8632c8) returned 0x0 [0243.993] WbemDefPath:IUnknown:AddRef (This=0x8632c8) returned 0x3 [0243.993] WbemDefPath:IUnknown:Release (This=0x8632c8) returned 0x2 [0243.993] WbemDefPath:IWbemPath:SetText (This=0x8632c8, uMode=0x4, pszPath="Win32_OperatingSystem") returned 0x0 [0243.993] WbemDefPath:IWbemPath:GetInfo (in: This=0x8632c8, uRequestedInfo=0x0, puResponse=0x19f3d0 | out: puResponse=0x19f3d0*=0xc15) returned 0x0 [0243.993] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8632c8, puCount=0x19f3c8 | out: puCount=0x19f3c8*=0x0) returned 0x0 [0243.995] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f3a0 | out: puCount=0x19f3a0*=0x2) returned 0x0 [0243.995] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f39c*=0x0, pszText=0x0 | out: puBuffLength=0x19f39c*=0xf, pszText=0x0) returned 0x0 [0243.995] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f39c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f39c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0244.027] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f23c*=0x51c, lpdwindex=0x19f0ec | out: lpdwindex=0x19f0ec) returned 0x0 [0244.027] CoGetContextToken (in: pToken=0x19e104 | out: pToken=0x19e104) returned 0x0 [0244.027] CoGetContextToken (in: pToken=0x19e0c4 | out: pToken=0x19e0c4) returned 0x0 [0244.027] WbemLocator:IUnknown:Release (This=0x835440) returned 0x1 [0244.027] IUnknown:Release (This=0x87e4b0) returned 0x0 [0244.096] CoGetContextToken (in: pToken=0x19e104 | out: pToken=0x19e104) returned 0x0 [0244.096] CoGetContextToken (in: pToken=0x19e0c4 | out: pToken=0x19e0c4) returned 0x0 [0244.096] WbemLocator:IUnknown:Release (This=0x89c608) returned 0x1 [0244.096] IUnknown:Release (This=0x87e708) returned 0x0 [0244.135] CoGetContextToken (in: pToken=0x19eff8 | out: pToken=0x19eff8) returned 0x0 [0244.135] CoGetContextToken (in: pToken=0x19efa0 | out: pToken=0x19efa0) returned 0x0 [0244.135] IUnknown:QueryInterface (in: This=0x810138, riid=0x6b2e8724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef80 | out: ppvObject=0x19ef80*=0x810148) returned 0x0 [0244.136] CObjectContext::ContextCallback () returned 0x0 [0244.139] IUnknown:Release (This=0x810148) returned 0x1 [0244.139] CoUnmarshalInterface (in: pStm=0x865790, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19efe8 | out: ppv=0x19efe8*=0x89c408) returned 0x0 [0244.139] CoMarshalInterface (pStm=0x865790, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x89c408, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0244.140] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee8c | out: ppvObject=0x19ee8c*=0x89c408) returned 0x0 [0244.140] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee48 | out: ppvObject=0x19ee48*=0x0) returned 0x80004002 [0244.141] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec64 | out: ppvObject=0x19ec64*=0x0) returned 0x80004002 [0244.141] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x0) returned 0x80004002 [0244.142] WbemLocator:IUnknown:AddRef (This=0x89c408) returned 0x3 [0244.142] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7a4 | out: ppvObject=0x19e7a4*=0x0) returned 0x80004002 [0244.142] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e754 | out: ppvObject=0x19e754*=0x0) returned 0x80004002 [0244.142] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x89c364) returned 0x0 [0244.142] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89c364, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e768 | out: pCid=0x19e768*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0244.142] WbemLocator:IUnknown:Release (This=0x89c364) returned 0x3 [0244.142] CoGetContextToken (in: pToken=0x19e7c0 | out: pToken=0x19e7c0) returned 0x0 [0244.142] CoGetObjectContext (in: riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x8c0334 | out: ppv=0x8c0334*=0x810080) returned 0x0 [0244.142] CoGetContextToken (in: pToken=0x19ebc8 | out: pToken=0x19ebc8) returned 0x0 [0244.142] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec58 | out: ppvObject=0x19ec58*=0x89c3ec) returned 0x0 [0244.143] WbemLocator:IRpcOptions:Query (in: This=0x89c3ec, pPrx=0x89c408, dwProperty=2, pdwValue=0x19ec80 | out: pdwValue=0x19ec80) returned 0x0 [0244.143] WbemLocator:IUnknown:Release (This=0x89c3ec) returned 0x3 [0244.143] WbemLocator:IUnknown:Release (This=0x89c408) returned 0x2 [0244.143] WbemLocator:IUnknown:Release (This=0x89c408) returned 0x1 [0244.143] CoGetContextToken (in: pToken=0x19ef38 | out: pToken=0x19ef38) returned 0x0 [0244.143] WbemLocator:IUnknown:AddRef (This=0x89c408) returned 0x2 [0244.143] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f4 | out: ppvObject=0x19f1f4*=0x89c3e4) returned 0x0 [0244.143] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89c3e4, pProxy=0x89c408, pAuthnSvc=0x19f244, pAuthzSvc=0x19f240, pServerPrincName=0x19f238, pAuthnLevel=0x19f23c, pImpLevel=0x19f22c, pAuthInfo=0x19f230, pCapabilites=0x19f234 | out: pAuthnSvc=0x19f244*=0xa, pAuthzSvc=0x19f240*=0x0, pServerPrincName=0x19f238, pAuthnLevel=0x19f23c*=0x6, pImpLevel=0x19f22c*=0x2, pAuthInfo=0x19f230, pCapabilites=0x19f234*=0x1) returned 0x0 [0244.143] WbemLocator:IUnknown:Release (This=0x89c3e4) returned 0x2 [0244.143] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1e8 | out: ppvObject=0x19f1e8*=0x89c408) returned 0x0 [0244.143] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1e4 | out: ppvObject=0x19f1e4*=0x89c3e4) returned 0x0 [0244.143] WbemLocator:IClientSecurity:SetBlanket (This=0x89c3e4, pProxy=0x89c408, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0244.144] WbemLocator:IUnknown:Release (This=0x89c3e4) returned 0x3 [0244.144] WbemLocator:IUnknown:Release (This=0x89c408) returned 0x2 [0244.144] CoTaskMemFree (pv=0x86f1e0) [0244.144] WbemLocator:IUnknown:Release (This=0x89c408) returned 0x1 [0244.144] SysStringLen (param_1=0x0) returned 0x0 [0244.144] CoGetContextToken (in: pToken=0x19f1b0 | out: pToken=0x19f1b0) returned 0x0 [0244.144] CoGetContextToken (in: pToken=0x19f110 | out: pToken=0x19f110) returned 0x0 [0244.144] WbemLocator:IUnknown:QueryInterface (in: This=0x89c408, riid=0x19f1e0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f1dc | out: ppvObject=0x19f1dc*=0x8a4038) returned 0x0 [0244.145] WbemLocator:IUnknown:AddRef (This=0x8a4038) returned 0x3 [0244.145] WbemLocator:IUnknown:Release (This=0x8a4038) returned 0x2 [0244.145] CoGetContextToken (in: pToken=0x19f170 | out: pToken=0x19f170) returned 0x0 [0244.145] WbemLocator:IUnknown:AddRef (This=0x8a4038) returned 0x3 [0244.145] WbemLocator:IUnknown:QueryInterface (in: This=0x8a4038, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f4 | out: ppvObject=0x19f1f4*=0x89c3e4) returned 0x0 [0244.146] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89c3e4, pProxy=0x8a4038, pAuthnSvc=0x19f244, pAuthzSvc=0x19f240, pServerPrincName=0x19f238, pAuthnLevel=0x19f23c, pImpLevel=0x19f22c, pAuthInfo=0x19f230, pCapabilites=0x19f234 | out: pAuthnSvc=0x19f244*=0xa, pAuthzSvc=0x19f240*=0x0, pServerPrincName=0x19f238, pAuthnLevel=0x19f23c*=0x6, pImpLevel=0x19f22c*=0x2, pAuthInfo=0x19f230, pCapabilites=0x19f234*=0x1) returned 0x0 [0244.146] WbemLocator:IUnknown:Release (This=0x89c3e4) returned 0x3 [0244.146] WbemLocator:IUnknown:QueryInterface (in: This=0x8a4038, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1e8 | out: ppvObject=0x19f1e8*=0x89c408) returned 0x0 [0244.146] WbemLocator:IUnknown:QueryInterface (in: This=0x8a4038, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1e4 | out: ppvObject=0x19f1e4*=0x89c3e4) returned 0x0 [0244.146] WbemLocator:IClientSecurity:SetBlanket (This=0x89c3e4, pProxy=0x8a4038, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0244.146] WbemLocator:IUnknown:Release (This=0x89c3e4) returned 0x4 [0244.146] WbemLocator:IUnknown:Release (This=0x89c408) returned 0x3 [0244.146] CoTaskMemFree (pv=0x86f360) [0244.148] WbemLocator:IUnknown:Release (This=0x8a4038) returned 0x2 [0244.148] SysStringLen (param_1=0x0) returned 0x0 [0244.148] CoGetContextToken (in: pToken=0x19f0e8 | out: pToken=0x19f0e8) returned 0x0 [0244.148] WbemLocator:IUnknown:AddRef (This=0x8a4038) returned 0x3 [0244.148] IWbemServices:ExecQuery (in: This=0x8a4038, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x19f300 | out: ppEnum=0x19f300*=0x87da88) returned 0x0 [0244.258] IUnknown:QueryInterface (in: This=0x87da88, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f158 | out: ppvObject=0x19f158*=0x87da8c) returned 0x0 [0244.258] IClientSecurity:QueryBlanket (in: This=0x87da8c, pProxy=0x87da88, pAuthnSvc=0x19f1a8, pAuthzSvc=0x19f1a4, pServerPrincName=0x19f19c, pAuthnLevel=0x19f1a0, pImpLevel=0x19f190, pAuthInfo=0x19f194, pCapabilites=0x19f198 | out: pAuthnSvc=0x19f1a8*=0xa, pAuthzSvc=0x19f1a4*=0x0, pServerPrincName=0x19f19c, pAuthnLevel=0x19f1a0*=0x6, pImpLevel=0x19f190*=0x2, pAuthInfo=0x19f194, pCapabilites=0x19f198*=0x1) returned 0x0 [0244.258] IUnknown:Release (This=0x87da8c) returned 0x1 [0244.258] IUnknown:QueryInterface (in: This=0x87da88, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f14c | out: ppvObject=0x19f14c*=0x89c808) returned 0x0 [0244.258] IUnknown:QueryInterface (in: This=0x87da88, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f148 | out: ppvObject=0x19f148*=0x87da8c) returned 0x0 [0244.258] IClientSecurity:SetBlanket (This=0x87da8c, pProxy=0x87da88, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0244.263] IUnknown:Release (This=0x87da8c) returned 0x2 [0244.263] WbemLocator:IUnknown:Release (This=0x89c808) returned 0x1 [0244.263] CoTaskMemFree (pv=0x86f090) [0244.263] IUnknown:QueryInterface (in: This=0x87da88, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed44 | out: ppvObject=0x19ed44*=0x89c808) returned 0x0 [0244.264] WbemLocator:IUnknown:QueryInterface (in: This=0x89c808, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ed00 | out: ppvObject=0x19ed00*=0x0) returned 0x80004002 [0244.264] WbemLocator:IUnknown:QueryInterface (in: This=0x89c808, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eb1c | out: ppvObject=0x19eb1c*=0x0) returned 0x80004002 [0244.265] IUnknown:QueryInterface (in: This=0x87da88, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e8f4 | out: ppvObject=0x19e8f4*=0x0) returned 0x80004002 [0244.265] WbemLocator:IUnknown:AddRef (This=0x89c808) returned 0x3 [0244.265] WbemLocator:IUnknown:QueryInterface (in: This=0x89c808, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e65c | out: ppvObject=0x19e65c*=0x0) returned 0x80004002 [0244.265] WbemLocator:IUnknown:QueryInterface (in: This=0x89c808, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0244.265] WbemLocator:IUnknown:QueryInterface (in: This=0x89c808, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e618 | out: ppvObject=0x19e618*=0x89c764) returned 0x0 [0244.265] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89c764, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e620 | out: pCid=0x19e620*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0244.265] WbemLocator:IUnknown:Release (This=0x89c764) returned 0x3 [0244.265] CoGetContextToken (in: pToken=0x19e678 | out: pToken=0x19e678) returned 0x0 [0244.265] CoGetContextToken (in: pToken=0x19ea80 | out: pToken=0x19ea80) returned 0x0 [0244.265] WbemLocator:IUnknown:QueryInterface (in: This=0x89c808, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eb10 | out: ppvObject=0x19eb10*=0x89c7ec) returned 0x0 [0244.266] WbemLocator:IRpcOptions:Query (in: This=0x89c7ec, pPrx=0x89c808, dwProperty=2, pdwValue=0x19eb38 | out: pdwValue=0x19eb38) returned 0x80004002 [0244.266] WbemLocator:IUnknown:Release (This=0x89c7ec) returned 0x3 [0244.266] WbemLocator:IUnknown:Release (This=0x89c808) returned 0x2 [0244.266] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0244.266] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0244.266] WbemLocator:IUnknown:QueryInterface (in: This=0x89c808, riid=0x19f088*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x87da88) returned 0x0 [0244.266] IUnknown:AddRef (This=0x87da88) returned 0x4 [0244.266] IUnknown:Release (This=0x87da88) returned 0x3 [0244.266] IUnknown:Release (This=0x87da88) returned 0x2 [0244.266] WbemLocator:IUnknown:Release (This=0x8a4038) returned 0x2 [0244.266] SysStringLen (param_1=0x0) returned 0x0 [0244.266] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f34c | out: puCount=0x19f34c*=0x2) returned 0x0 [0244.266] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f348*=0x0, pszText=0x0 | out: puBuffLength=0x19f348*=0xf, pszText=0x0) returned 0x0 [0244.266] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f348*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f348*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0244.266] CoGetContextToken (in: pToken=0x19f188 | out: pToken=0x19f188) returned 0x0 [0244.266] IUnknown:AddRef (This=0x87da88) returned 0x3 [0244.266] IEnumWbemClassObject:Clone (in: This=0x87da88, ppEnum=0x19f348 | out: ppEnum=0x19f348*=0x87e320) returned 0x0 [0244.272] IUnknown:QueryInterface (in: This=0x87e320, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f20c | out: ppvObject=0x19f20c*=0x87e324) returned 0x0 [0244.272] IClientSecurity:QueryBlanket (in: This=0x87e324, pProxy=0x87e320, pAuthnSvc=0x19f25c, pAuthzSvc=0x19f258, pServerPrincName=0x19f250, pAuthnLevel=0x19f254, pImpLevel=0x19f244, pAuthInfo=0x19f248, pCapabilites=0x19f24c | out: pAuthnSvc=0x19f25c*=0xa, pAuthzSvc=0x19f258*=0x0, pServerPrincName=0x19f250, pAuthnLevel=0x19f254*=0x6, pImpLevel=0x19f244*=0x2, pAuthInfo=0x19f248, pCapabilites=0x19f24c*=0x1) returned 0x0 [0244.272] IUnknown:Release (This=0x87e324) returned 0x1 [0244.272] IUnknown:QueryInterface (in: This=0x87e320, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f200 | out: ppvObject=0x19f200*=0x89bf08) returned 0x0 [0244.273] IUnknown:QueryInterface (in: This=0x87e320, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x87e324) returned 0x0 [0244.273] IClientSecurity:SetBlanket (This=0x87e324, pProxy=0x87e320, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0244.275] IUnknown:Release (This=0x87e324) returned 0x2 [0244.275] WbemLocator:IUnknown:Release (This=0x89bf08) returned 0x1 [0244.275] CoTaskMemFree (pv=0x86f450) [0244.275] IUnknown:QueryInterface (in: This=0x87e320, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ede8 | out: ppvObject=0x19ede8*=0x89bf08) returned 0x0 [0244.276] WbemLocator:IUnknown:QueryInterface (in: This=0x89bf08, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19eda4 | out: ppvObject=0x19eda4*=0x0) returned 0x80004002 [0244.277] WbemLocator:IUnknown:QueryInterface (in: This=0x89bf08, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ebc4 | out: ppvObject=0x19ebc4*=0x0) returned 0x80004002 [0244.278] IUnknown:QueryInterface (in: This=0x87e320, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e99c | out: ppvObject=0x19e99c*=0x0) returned 0x80004002 [0244.279] WbemLocator:IUnknown:AddRef (This=0x89bf08) returned 0x3 [0244.279] WbemLocator:IUnknown:QueryInterface (in: This=0x89bf08, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e704 | out: ppvObject=0x19e704*=0x0) returned 0x80004002 [0244.279] WbemLocator:IUnknown:QueryInterface (in: This=0x89bf08, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6b4 | out: ppvObject=0x19e6b4*=0x0) returned 0x80004002 [0244.279] WbemLocator:IUnknown:QueryInterface (in: This=0x89bf08, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6c0 | out: ppvObject=0x19e6c0*=0x89be64) returned 0x0 [0244.279] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89be64, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e6c8 | out: pCid=0x19e6c8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0244.279] WbemLocator:IUnknown:Release (This=0x89be64) returned 0x3 [0244.279] CoGetContextToken (in: pToken=0x19e720 | out: pToken=0x19e720) returned 0x0 [0244.279] CoGetContextToken (in: pToken=0x19eb28 | out: pToken=0x19eb28) returned 0x0 [0244.279] WbemLocator:IUnknown:QueryInterface (in: This=0x89bf08, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebb8 | out: ppvObject=0x19ebb8*=0x89beec) returned 0x0 [0244.279] WbemLocator:IRpcOptions:Query (in: This=0x89beec, pPrx=0x89bf08, dwProperty=2, pdwValue=0x19ebe0 | out: pdwValue=0x19ebe0) returned 0x80004002 [0244.279] WbemLocator:IUnknown:Release (This=0x89beec) returned 0x3 [0244.280] WbemLocator:IUnknown:Release (This=0x89bf08) returned 0x2 [0244.280] CoGetContextToken (in: pToken=0x19f0f8 | out: pToken=0x19f0f8) returned 0x0 [0244.280] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0244.280] WbemLocator:IUnknown:QueryInterface (in: This=0x89bf08, riid=0x19f128*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f124 | out: ppvObject=0x19f124*=0x87e320) returned 0x0 [0244.280] IUnknown:AddRef (This=0x87e320) returned 0x4 [0244.280] IUnknown:Release (This=0x87e320) returned 0x3 [0244.280] IUnknown:Release (This=0x87e320) returned 0x2 [0244.280] IUnknown:Release (This=0x87da88) returned 0x2 [0244.280] SysStringLen (param_1=0x0) returned 0x0 [0244.280] IEnumWbemClassObject:Reset (This=0x87e320) returned 0x0 [0244.281] CoTaskMemAlloc (cb=0x4) returned 0x887e68 [0244.282] IEnumWbemClassObject:Next (in: This=0x87e320, lTimeout=-1, uCount=0x1, apObjects=0x887e68, puReturned=0x237666c | out: apObjects=0x887e68*=0x83afc8, puReturned=0x237666c*=0x1) returned 0x0 [0244.298] IUnknown:QueryInterface (in: This=0x83afc8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9a8 | out: ppvObject=0x19e9a8*=0x83afc8) returned 0x0 [0244.298] IUnknown:QueryInterface (in: This=0x83afc8, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e964 | out: ppvObject=0x19e964*=0x0) returned 0x80004002 [0244.298] IUnknown:QueryInterface (in: This=0x83afc8, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e784 | out: ppvObject=0x19e784*=0x0) returned 0x80004002 [0244.298] IUnknown:QueryInterface (in: This=0x83afc8, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e55c | out: ppvObject=0x19e55c*=0x0) returned 0x80004002 [0244.299] IUnknown:AddRef (This=0x83afc8) returned 0x3 [0244.299] IUnknown:QueryInterface (in: This=0x83afc8, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2c4 | out: ppvObject=0x19e2c4*=0x0) returned 0x80004002 [0244.299] IUnknown:QueryInterface (in: This=0x83afc8, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e274 | out: ppvObject=0x19e274*=0x0) returned 0x80004002 [0244.299] IUnknown:QueryInterface (in: This=0x83afc8, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e280 | out: ppvObject=0x19e280*=0x83afcc) returned 0x0 [0244.299] IMarshal:GetUnmarshalClass (in: This=0x83afcc, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e288 | out: pCid=0x19e288*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0244.299] IUnknown:Release (This=0x83afcc) returned 0x3 [0244.299] CoGetContextToken (in: pToken=0x19e2e0 | out: pToken=0x19e2e0) returned 0x0 [0244.299] CoGetContextToken (in: pToken=0x19e6e8 | out: pToken=0x19e6e8) returned 0x0 [0244.300] IUnknown:QueryInterface (in: This=0x83afc8, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e778 | out: ppvObject=0x19e778*=0x0) returned 0x80004002 [0244.300] IUnknown:Release (This=0x83afc8) returned 0x2 [0244.300] CoGetContextToken (in: pToken=0x19ecb8 | out: pToken=0x19ecb8) returned 0x0 [0244.300] CoGetContextToken (in: pToken=0x19ec18 | out: pToken=0x19ec18) returned 0x0 [0244.300] IUnknown:QueryInterface (in: This=0x83afc8, riid=0x19ece8*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ece4 | out: ppvObject=0x19ece4*=0x83afc8) returned 0x0 [0244.300] IUnknown:AddRef (This=0x83afc8) returned 0x4 [0244.300] IUnknown:Release (This=0x83afc8) returned 0x3 [0244.300] IUnknown:Release (This=0x83afc8) returned 0x2 [0244.301] CoTaskMemFree (pv=0x887e68) [0244.301] CoGetContextToken (in: pToken=0x19f028 | out: pToken=0x19f028) returned 0x0 [0244.301] IUnknown:AddRef (This=0x83afc8) returned 0x3 [0244.301] CoTaskMemAlloc (cb=0x4) returned 0x887e68 [0244.301] IEnumWbemClassObject:Next (in: This=0x87e320, lTimeout=-1, uCount=0x1, apObjects=0x887e68, puReturned=0x237666c | out: apObjects=0x887e68*=0x0, puReturned=0x237666c*=0x0) returned 0x1 [0244.304] CoTaskMemFree (pv=0x887e68) [0244.304] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0244.304] IUnknown:AddRef (This=0x87da88) returned 0x3 [0244.304] IEnumWbemClassObject:Clone (in: This=0x87da88, ppEnum=0x19f358 | out: ppEnum=0x19f358*=0x87dc18) returned 0x0 [0244.312] IUnknown:QueryInterface (in: This=0x87dc18, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f21c | out: ppvObject=0x19f21c*=0x87dc1c) returned 0x0 [0244.313] IClientSecurity:QueryBlanket (in: This=0x87dc1c, pProxy=0x87dc18, pAuthnSvc=0x19f26c, pAuthzSvc=0x19f268, pServerPrincName=0x19f260, pAuthnLevel=0x19f264, pImpLevel=0x19f254, pAuthInfo=0x19f258, pCapabilites=0x19f25c | out: pAuthnSvc=0x19f26c*=0xa, pAuthzSvc=0x19f268*=0x0, pServerPrincName=0x19f260, pAuthnLevel=0x19f264*=0x6, pImpLevel=0x19f254*=0x2, pAuthInfo=0x19f258, pCapabilites=0x19f25c*=0x1) returned 0x0 [0244.313] IUnknown:Release (This=0x87dc1c) returned 0x1 [0244.313] IUnknown:QueryInterface (in: This=0x87dc18, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f210 | out: ppvObject=0x19f210*=0x89ca08) returned 0x0 [0244.313] IUnknown:QueryInterface (in: This=0x87dc18, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f20c | out: ppvObject=0x19f20c*=0x87dc1c) returned 0x0 [0244.313] IClientSecurity:SetBlanket (This=0x87dc1c, pProxy=0x87dc18, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0244.326] IUnknown:Release (This=0x87dc1c) returned 0x2 [0244.326] WbemLocator:IUnknown:Release (This=0x89ca08) returned 0x1 [0244.326] CoTaskMemFree (pv=0x86f480) [0244.327] IUnknown:QueryInterface (in: This=0x87dc18, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19edf8 | out: ppvObject=0x19edf8*=0x89ca08) returned 0x0 [0244.327] WbemLocator:IUnknown:QueryInterface (in: This=0x89ca08, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edb4 | out: ppvObject=0x19edb4*=0x0) returned 0x80004002 [0244.330] WbemLocator:IUnknown:QueryInterface (in: This=0x89ca08, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ebd4 | out: ppvObject=0x19ebd4*=0x0) returned 0x80004002 [0244.332] IUnknown:QueryInterface (in: This=0x87dc18, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9ac | out: ppvObject=0x19e9ac*=0x0) returned 0x80004002 [0244.334] WbemLocator:IUnknown:AddRef (This=0x89ca08) returned 0x3 [0244.334] WbemLocator:IUnknown:QueryInterface (in: This=0x89ca08, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e714 | out: ppvObject=0x19e714*=0x0) returned 0x80004002 [0244.334] WbemLocator:IUnknown:QueryInterface (in: This=0x89ca08, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6c4 | out: ppvObject=0x19e6c4*=0x0) returned 0x80004002 [0244.334] WbemLocator:IUnknown:QueryInterface (in: This=0x89ca08, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6d0 | out: ppvObject=0x19e6d0*=0x89c964) returned 0x0 [0244.334] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89c964, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e6d8 | out: pCid=0x19e6d8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0244.334] WbemLocator:IUnknown:Release (This=0x89c964) returned 0x3 [0244.335] CoGetContextToken (in: pToken=0x19e730 | out: pToken=0x19e730) returned 0x0 [0244.335] CoGetContextToken (in: pToken=0x19eb38 | out: pToken=0x19eb38) returned 0x0 [0244.335] WbemLocator:IUnknown:QueryInterface (in: This=0x89ca08, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebc8 | out: ppvObject=0x19ebc8*=0x89c9ec) returned 0x0 [0244.335] WbemLocator:IRpcOptions:Query (in: This=0x89c9ec, pPrx=0x89ca08, dwProperty=2, pdwValue=0x19ebf0 | out: pdwValue=0x19ebf0) returned 0x80004002 [0244.335] WbemLocator:IUnknown:Release (This=0x89c9ec) returned 0x3 [0244.336] WbemLocator:IUnknown:Release (This=0x89ca08) returned 0x2 [0244.336] CoGetContextToken (in: pToken=0x19f108 | out: pToken=0x19f108) returned 0x0 [0244.336] CoGetContextToken (in: pToken=0x19f068 | out: pToken=0x19f068) returned 0x0 [0244.336] WbemLocator:IUnknown:QueryInterface (in: This=0x89ca08, riid=0x19f138*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f134 | out: ppvObject=0x19f134*=0x87dc18) returned 0x0 [0244.336] IUnknown:AddRef (This=0x87dc18) returned 0x4 [0244.336] IUnknown:Release (This=0x87dc18) returned 0x3 [0244.336] IUnknown:Release (This=0x87dc18) returned 0x2 [0244.337] IUnknown:Release (This=0x87da88) returned 0x2 [0244.337] SysStringLen (param_1=0x0) returned 0x0 [0244.337] IEnumWbemClassObject:Reset (This=0x87dc18) returned 0x0 [0244.344] CoTaskMemAlloc (cb=0x4) returned 0x887ce8 [0244.344] IEnumWbemClassObject:Next (in: This=0x87dc18, lTimeout=-1, uCount=0x1, apObjects=0x887ce8, puReturned=0x2376750 | out: apObjects=0x887ce8*=0x89bb18, puReturned=0x2376750*=0x1) returned 0x0 [0244.368] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9b8 | out: ppvObject=0x19e9b8*=0x89bb18) returned 0x0 [0244.368] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e974 | out: ppvObject=0x19e974*=0x0) returned 0x80004002 [0244.368] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e794 | out: ppvObject=0x19e794*=0x0) returned 0x80004002 [0244.369] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e56c | out: ppvObject=0x19e56c*=0x0) returned 0x80004002 [0244.369] IUnknown:AddRef (This=0x89bb18) returned 0x3 [0244.369] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2d4 | out: ppvObject=0x19e2d4*=0x0) returned 0x80004002 [0244.369] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e284 | out: ppvObject=0x19e284*=0x0) returned 0x80004002 [0244.369] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e290 | out: ppvObject=0x19e290*=0x89bb1c) returned 0x0 [0244.370] IMarshal:GetUnmarshalClass (in: This=0x89bb1c, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e298 | out: pCid=0x19e298*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0244.370] IUnknown:Release (This=0x89bb1c) returned 0x3 [0244.370] CoGetContextToken (in: pToken=0x19e2f0 | out: pToken=0x19e2f0) returned 0x0 [0244.370] CoGetContextToken (in: pToken=0x19e6f8 | out: pToken=0x19e6f8) returned 0x0 [0244.370] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e788 | out: ppvObject=0x19e788*=0x0) returned 0x80004002 [0244.370] IUnknown:Release (This=0x89bb18) returned 0x2 [0244.371] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0244.371] CoGetContextToken (in: pToken=0x19ec28 | out: pToken=0x19ec28) returned 0x0 [0244.371] IUnknown:QueryInterface (in: This=0x89bb18, riid=0x19ecf8*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ecf4 | out: ppvObject=0x19ecf4*=0x89bb18) returned 0x0 [0244.371] IUnknown:AddRef (This=0x89bb18) returned 0x4 [0244.371] IUnknown:Release (This=0x89bb18) returned 0x3 [0244.372] IUnknown:Release (This=0x89bb18) returned 0x2 [0244.372] CoTaskMemFree (pv=0x887ce8) [0244.372] CoGetContextToken (in: pToken=0x19f038 | out: pToken=0x19f038) returned 0x0 [0244.372] IUnknown:AddRef (This=0x89bb18) returned 0x3 [0244.372] IWbemClassObject:Get (in: This=0x89bb18, wszName="__GENUS", lFlags=0, pVal=0x19f348*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3c8*=0, plFlavor=0x19f3c4*=0 | out: pVal=0x19f348*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f3c8*=3, plFlavor=0x19f3c4*=64) returned 0x0 [0244.373] IWbemClassObject:Get (in: This=0x89bb18, wszName="__PATH", lFlags=0, pVal=0x19f32c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3b0*=0, plFlavor=0x19f3ac*=0 | out: pVal=0x19f32c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x19f3b0*=8, plFlavor=0x19f3ac*=64) returned 0x0 [0244.374] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0244.374] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0244.375] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x520 [0244.375] SetEvent (hEvent=0x3b0) returned 1 [0244.376] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f304*=0x520, lpdwindex=0x19f124 | out: lpdwindex=0x19f124) returned 0x0 [0244.417] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0244.417] CoGetContextToken (in: pToken=0x19f130 | out: pToken=0x19f130) returned 0x0 [0244.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x19f200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x8633a8) returned 0x0 [0244.417] WbemDefPath:IUnknown:AddRef (This=0x8633a8) returned 0x3 [0244.417] WbemDefPath:IUnknown:Release (This=0x8633a8) returned 0x2 [0244.418] WbemDefPath:IWbemPath:SetText (This=0x8633a8, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0244.418] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f384 | out: puCount=0x19f384*=0x2) returned 0x0 [0244.418] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f380*=0x0, pszText=0x0 | out: puBuffLength=0x19f380*=0xf, pszText=0x0) returned 0x0 [0244.418] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f380*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f380*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0244.418] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f378 | out: puCount=0x19f378*=0x2) returned 0x0 [0244.418] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f374*=0x0, pszText=0x0 | out: puBuffLength=0x19f374*=0xf, pszText=0x0) returned 0x0 [0244.418] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f374*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f374*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0244.418] IWbemClassObject:Get (in: This=0x89bb18, wszName="Name", lFlags=0, pVal=0x19f374*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2376fac*=0, plFlavor=0x2376fb0*=0 | out: pVal=0x19f374*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x2376fac*=8, plFlavor=0x2376fb0*=0) returned 0x0 [0244.419] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0244.419] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0244.419] IWbemClassObject:Get (in: This=0x89bb18, wszName="Name", lFlags=0, pVal=0x19f37c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2376fac*=8, plFlavor=0x2376fb0*=0 | out: pVal=0x19f37c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x2376fac*=8, plFlavor=0x2376fb0*=0) returned 0x0 [0244.419] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0244.419] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0244.487] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f390 | out: puCount=0x19f390*=0x2) returned 0x0 [0244.487] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f38c*=0x0, pszText=0x0 | out: puBuffLength=0x19f38c*=0xf, pszText=0x0) returned 0x0 [0244.487] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0244.508] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f23c*=0x444, lpdwindex=0x19f0ec | out: lpdwindex=0x19f0ec) returned 0x0 [0244.543] CoGetContextToken (in: pToken=0x19eff8 | out: pToken=0x19eff8) returned 0x0 [0244.545] CoGetContextToken (in: pToken=0x19efa0 | out: pToken=0x19efa0) returned 0x0 [0244.545] IUnknown:QueryInterface (in: This=0x810138, riid=0x6b2e8724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef80 | out: ppvObject=0x19ef80*=0x810148) returned 0x0 [0244.545] CObjectContext::ContextCallback () returned 0x0 [0244.547] IUnknown:Release (This=0x810148) returned 0x1 [0244.548] CoUnmarshalInterface (in: pStm=0x865730, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19efe8 | out: ppv=0x19efe8*=0x89c708) returned 0x0 [0244.548] CoMarshalInterface (pStm=0x865730, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x89c708, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0244.549] WbemLocator:IUnknown:QueryInterface (in: This=0x89c708, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee8c | out: ppvObject=0x19ee8c*=0x89c708) returned 0x0 [0244.549] WbemLocator:IUnknown:QueryInterface (in: This=0x89c708, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee48 | out: ppvObject=0x19ee48*=0x0) returned 0x80004002 [0244.550] WbemLocator:IUnknown:QueryInterface (in: This=0x89c708, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec64 | out: ppvObject=0x19ec64*=0x0) returned 0x80004002 [0244.550] WbemLocator:IUnknown:QueryInterface (in: This=0x89c708, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x0) returned 0x80004002 [0244.551] WbemLocator:IUnknown:AddRef (This=0x89c708) returned 0x3 [0244.551] WbemLocator:IUnknown:QueryInterface (in: This=0x89c708, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7a4 | out: ppvObject=0x19e7a4*=0x0) returned 0x80004002 [0244.551] WbemLocator:IUnknown:QueryInterface (in: This=0x89c708, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e754 | out: ppvObject=0x19e754*=0x0) returned 0x80004002 [0244.551] WbemLocator:IUnknown:QueryInterface (in: This=0x89c708, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x89c664) returned 0x0 [0244.551] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89c664, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e768 | out: pCid=0x19e768*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0244.551] WbemLocator:IUnknown:Release (This=0x89c664) returned 0x3 [0244.551] CoGetContextToken (in: pToken=0x19e7c0 | out: pToken=0x19e7c0) returned 0x0 [0244.551] CoGetContextToken (in: pToken=0x19ebc8 | out: pToken=0x19ebc8) returned 0x0 [0244.551] WbemLocator:IUnknown:QueryInterface (in: This=0x89c708, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec58 | out: ppvObject=0x19ec58*=0x89c6ec) returned 0x0 [0244.551] WbemLocator:IRpcOptions:Query (in: This=0x89c6ec, pPrx=0x89c708, dwProperty=2, pdwValue=0x19ec80 | out: pdwValue=0x19ec80) returned 0x0 [0244.551] WbemLocator:IUnknown:Release (This=0x89c6ec) returned 0x3 [0244.552] WbemLocator:IUnknown:Release (This=0x89c708) returned 0x2 [0244.552] WbemLocator:IUnknown:Release (This=0x89c708) returned 0x1 [0244.552] CoGetContextToken (in: pToken=0x19ef38 | out: pToken=0x19ef38) returned 0x0 [0244.552] WbemLocator:IUnknown:AddRef (This=0x89c708) returned 0x2 [0244.552] WbemLocator:IUnknown:QueryInterface (in: This=0x89c708, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f4 | out: ppvObject=0x19f1f4*=0x89c6e4) returned 0x0 [0244.552] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89c6e4, pProxy=0x89c708, pAuthnSvc=0x19f244, pAuthzSvc=0x19f240, pServerPrincName=0x19f238, pAuthnLevel=0x19f23c, pImpLevel=0x19f22c, pAuthInfo=0x19f230, pCapabilites=0x19f234 | out: pAuthnSvc=0x19f244*=0xa, pAuthzSvc=0x19f240*=0x0, pServerPrincName=0x19f238, pAuthnLevel=0x19f23c*=0x6, pImpLevel=0x19f22c*=0x2, pAuthInfo=0x19f230, pCapabilites=0x19f234*=0x1) returned 0x0 [0244.552] WbemLocator:IUnknown:Release (This=0x89c6e4) returned 0x2 [0244.552] WbemLocator:IUnknown:QueryInterface (in: This=0x89c708, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1e8 | out: ppvObject=0x19f1e8*=0x89c708) returned 0x0 [0244.552] WbemLocator:IUnknown:QueryInterface (in: This=0x89c708, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1e4 | out: ppvObject=0x19f1e4*=0x89c6e4) returned 0x0 [0244.552] WbemLocator:IClientSecurity:SetBlanket (This=0x89c6e4, pProxy=0x89c708, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0244.553] WbemLocator:IUnknown:Release (This=0x89c6e4) returned 0x3 [0244.553] WbemLocator:IUnknown:Release (This=0x89c708) returned 0x2 [0244.553] CoTaskMemFree (pv=0x86f510) [0244.553] WbemLocator:IUnknown:Release (This=0x89c708) returned 0x1 [0244.553] SysStringLen (param_1=0x0) returned 0x0 [0244.553] CoGetContextToken (in: pToken=0x19f1b0 | out: pToken=0x19f1b0) returned 0x0 [0244.553] CoGetContextToken (in: pToken=0x19f110 | out: pToken=0x19f110) returned 0x0 [0244.553] WbemLocator:IUnknown:QueryInterface (in: This=0x89c708, riid=0x19f1e0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f1dc | out: ppvObject=0x19f1dc*=0x8a3b88) returned 0x0 [0244.554] WbemLocator:IUnknown:AddRef (This=0x8a3b88) returned 0x3 [0244.554] WbemLocator:IUnknown:Release (This=0x8a3b88) returned 0x2 [0244.554] CoGetContextToken (in: pToken=0x19f170 | out: pToken=0x19f170) returned 0x0 [0244.554] WbemLocator:IUnknown:AddRef (This=0x8a3b88) returned 0x3 [0244.557] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3b88, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f4 | out: ppvObject=0x19f1f4*=0x89c6e4) returned 0x0 [0244.557] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89c6e4, pProxy=0x8a3b88, pAuthnSvc=0x19f244, pAuthzSvc=0x19f240, pServerPrincName=0x19f238, pAuthnLevel=0x19f23c, pImpLevel=0x19f22c, pAuthInfo=0x19f230, pCapabilites=0x19f234 | out: pAuthnSvc=0x19f244*=0xa, pAuthzSvc=0x19f240*=0x0, pServerPrincName=0x19f238, pAuthnLevel=0x19f23c*=0x6, pImpLevel=0x19f22c*=0x2, pAuthInfo=0x19f230, pCapabilites=0x19f234*=0x1) returned 0x0 [0244.557] WbemLocator:IUnknown:Release (This=0x89c6e4) returned 0x3 [0244.557] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3b88, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1e8 | out: ppvObject=0x19f1e8*=0x89c708) returned 0x0 [0244.557] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3b88, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1e4 | out: ppvObject=0x19f1e4*=0x89c6e4) returned 0x0 [0244.557] WbemLocator:IClientSecurity:SetBlanket (This=0x89c6e4, pProxy=0x8a3b88, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0244.557] WbemLocator:IUnknown:Release (This=0x89c6e4) returned 0x4 [0244.557] WbemLocator:IUnknown:Release (This=0x89c708) returned 0x3 [0244.558] CoTaskMemFree (pv=0x86f6c0) [0244.558] WbemLocator:IUnknown:Release (This=0x8a3b88) returned 0x2 [0244.558] SysStringLen (param_1=0x0) returned 0x0 [0244.558] CoGetContextToken (in: pToken=0x19f0f0 | out: pToken=0x19f0f0) returned 0x0 [0244.558] WbemLocator:IUnknown:AddRef (This=0x8a3b88) returned 0x3 [0244.558] IWbemServices:ExecQuery (in: This=0x8a3b88, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x19f300 | out: ppEnum=0x19f300*=0x87e640) returned 0x0 [0244.605] IUnknown:QueryInterface (in: This=0x87e640, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f164 | out: ppvObject=0x19f164*=0x87e644) returned 0x0 [0244.606] IClientSecurity:QueryBlanket (in: This=0x87e644, pProxy=0x87e640, pAuthnSvc=0x19f1b4, pAuthzSvc=0x19f1b0, pServerPrincName=0x19f1a8, pAuthnLevel=0x19f1ac, pImpLevel=0x19f19c, pAuthInfo=0x19f1a0, pCapabilites=0x19f1a4 | out: pAuthnSvc=0x19f1b4*=0xa, pAuthzSvc=0x19f1b0*=0x0, pServerPrincName=0x19f1a8, pAuthnLevel=0x19f1ac*=0x6, pImpLevel=0x19f19c*=0x2, pAuthInfo=0x19f1a0, pCapabilites=0x19f1a4*=0x1) returned 0x0 [0244.606] IUnknown:Release (This=0x87e644) returned 0x1 [0244.606] IUnknown:QueryInterface (in: This=0x87e640, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f158 | out: ppvObject=0x19f158*=0x89d508) returned 0x0 [0244.606] IUnknown:QueryInterface (in: This=0x87e640, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f154 | out: ppvObject=0x19f154*=0x87e644) returned 0x0 [0244.606] IClientSecurity:SetBlanket (This=0x87e644, pProxy=0x87e640, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0244.609] IUnknown:Release (This=0x87e644) returned 0x2 [0244.609] WbemLocator:IUnknown:Release (This=0x89d508) returned 0x1 [0244.609] CoTaskMemFree (pv=0x86f630) [0244.609] IUnknown:QueryInterface (in: This=0x87e640, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed50 | out: ppvObject=0x19ed50*=0x89d508) returned 0x0 [0244.609] WbemLocator:IUnknown:QueryInterface (in: This=0x89d508, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x0) returned 0x80004002 [0244.610] WbemLocator:IUnknown:QueryInterface (in: This=0x89d508, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eb2c | out: ppvObject=0x19eb2c*=0x0) returned 0x80004002 [0244.610] IUnknown:QueryInterface (in: This=0x87e640, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e904 | out: ppvObject=0x19e904*=0x0) returned 0x80004002 [0244.611] WbemLocator:IUnknown:AddRef (This=0x89d508) returned 0x3 [0244.611] WbemLocator:IUnknown:QueryInterface (in: This=0x89d508, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e66c | out: ppvObject=0x19e66c*=0x0) returned 0x80004002 [0244.611] WbemLocator:IUnknown:QueryInterface (in: This=0x89d508, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0244.611] WbemLocator:IUnknown:QueryInterface (in: This=0x89d508, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e628 | out: ppvObject=0x19e628*=0x89d464) returned 0x0 [0244.611] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89d464, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e630 | out: pCid=0x19e630*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0244.611] WbemLocator:IUnknown:Release (This=0x89d464) returned 0x3 [0244.611] CoGetContextToken (in: pToken=0x19e688 | out: pToken=0x19e688) returned 0x0 [0244.611] CoGetContextToken (in: pToken=0x19ea90 | out: pToken=0x19ea90) returned 0x0 [0244.612] WbemLocator:IUnknown:QueryInterface (in: This=0x89d508, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eb20 | out: ppvObject=0x19eb20*=0x89d4ec) returned 0x0 [0244.612] WbemLocator:IRpcOptions:Query (in: This=0x89d4ec, pPrx=0x89d508, dwProperty=2, pdwValue=0x19eb48 | out: pdwValue=0x19eb48) returned 0x80004002 [0244.612] WbemLocator:IUnknown:Release (This=0x89d4ec) returned 0x3 [0244.612] WbemLocator:IUnknown:Release (This=0x89d508) returned 0x2 [0244.612] CoGetContextToken (in: pToken=0x19f060 | out: pToken=0x19f060) returned 0x0 [0244.612] CoGetContextToken (in: pToken=0x19efc0 | out: pToken=0x19efc0) returned 0x0 [0244.612] WbemLocator:IUnknown:QueryInterface (in: This=0x89d508, riid=0x19f090*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f08c | out: ppvObject=0x19f08c*=0x87e640) returned 0x0 [0244.612] IUnknown:AddRef (This=0x87e640) returned 0x4 [0244.612] IUnknown:Release (This=0x87e640) returned 0x3 [0244.612] IUnknown:Release (This=0x87e640) returned 0x2 [0244.612] WbemLocator:IUnknown:Release (This=0x8a3b88) returned 0x2 [0244.612] SysStringLen (param_1=0x0) returned 0x0 [0244.612] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f34c | out: puCount=0x19f34c*=0x2) returned 0x0 [0244.612] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f348*=0x0, pszText=0x0 | out: puBuffLength=0x19f348*=0xf, pszText=0x0) returned 0x0 [0244.612] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f348*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f348*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0244.612] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0244.612] IUnknown:AddRef (This=0x87e640) returned 0x3 [0244.613] IEnumWbemClassObject:Clone (in: This=0x87e640, ppEnum=0x19f358 | out: ppEnum=0x19f358*=0x87e4b0) returned 0x0 [0244.614] IUnknown:QueryInterface (in: This=0x87e4b0, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f21c | out: ppvObject=0x19f21c*=0x87e4b4) returned 0x0 [0244.614] IClientSecurity:QueryBlanket (in: This=0x87e4b4, pProxy=0x87e4b0, pAuthnSvc=0x19f26c, pAuthzSvc=0x19f268, pServerPrincName=0x19f260, pAuthnLevel=0x19f264, pImpLevel=0x19f254, pAuthInfo=0x19f258, pCapabilites=0x19f25c | out: pAuthnSvc=0x19f26c*=0xa, pAuthzSvc=0x19f268*=0x0, pServerPrincName=0x19f260, pAuthnLevel=0x19f264*=0x6, pImpLevel=0x19f254*=0x2, pAuthInfo=0x19f258, pCapabilites=0x19f25c*=0x1) returned 0x0 [0244.614] IUnknown:Release (This=0x87e4b4) returned 0x1 [0244.614] IUnknown:QueryInterface (in: This=0x87e4b0, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f210 | out: ppvObject=0x19f210*=0x89d808) returned 0x0 [0244.614] IUnknown:QueryInterface (in: This=0x87e4b0, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f20c | out: ppvObject=0x19f20c*=0x87e4b4) returned 0x0 [0244.614] IClientSecurity:SetBlanket (This=0x87e4b4, pProxy=0x87e4b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0244.616] IUnknown:Release (This=0x87e4b4) returned 0x2 [0244.616] WbemLocator:IUnknown:Release (This=0x89d808) returned 0x1 [0244.617] CoTaskMemFree (pv=0x86f510) [0244.617] IUnknown:QueryInterface (in: This=0x87e4b0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19edf8 | out: ppvObject=0x19edf8*=0x89d808) returned 0x0 [0244.617] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edb4 | out: ppvObject=0x19edb4*=0x0) returned 0x80004002 [0244.618] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ebd4 | out: ppvObject=0x19ebd4*=0x0) returned 0x80004002 [0244.618] IUnknown:QueryInterface (in: This=0x87e4b0, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9ac | out: ppvObject=0x19e9ac*=0x0) returned 0x80004002 [0244.619] WbemLocator:IUnknown:AddRef (This=0x89d808) returned 0x3 [0244.619] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e714 | out: ppvObject=0x19e714*=0x0) returned 0x80004002 [0244.619] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6c4 | out: ppvObject=0x19e6c4*=0x0) returned 0x80004002 [0244.619] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6d0 | out: ppvObject=0x19e6d0*=0x89d764) returned 0x0 [0244.619] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89d764, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e6d8 | out: pCid=0x19e6d8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0244.619] WbemLocator:IUnknown:Release (This=0x89d764) returned 0x3 [0244.619] CoGetContextToken (in: pToken=0x19e730 | out: pToken=0x19e730) returned 0x0 [0244.619] CoGetContextToken (in: pToken=0x19eb38 | out: pToken=0x19eb38) returned 0x0 [0244.619] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebc8 | out: ppvObject=0x19ebc8*=0x89d7ec) returned 0x0 [0244.619] WbemLocator:IRpcOptions:Query (in: This=0x89d7ec, pPrx=0x89d808, dwProperty=2, pdwValue=0x19ebf0 | out: pdwValue=0x19ebf0) returned 0x80004002 [0244.620] WbemLocator:IUnknown:Release (This=0x89d7ec) returned 0x3 [0244.620] WbemLocator:IUnknown:Release (This=0x89d808) returned 0x2 [0244.620] CoGetContextToken (in: pToken=0x19f108 | out: pToken=0x19f108) returned 0x0 [0244.620] CoGetContextToken (in: pToken=0x19f068 | out: pToken=0x19f068) returned 0x0 [0244.620] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x19f138*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f134 | out: ppvObject=0x19f134*=0x87e4b0) returned 0x0 [0244.620] IUnknown:AddRef (This=0x87e4b0) returned 0x4 [0244.620] IUnknown:Release (This=0x87e4b0) returned 0x3 [0244.620] IUnknown:Release (This=0x87e4b0) returned 0x2 [0244.620] IUnknown:Release (This=0x87e640) returned 0x2 [0244.620] SysStringLen (param_1=0x0) returned 0x0 [0244.620] IEnumWbemClassObject:Reset (This=0x87e4b0) returned 0x0 [0244.621] CoTaskMemAlloc (cb=0x4) returned 0x887c08 [0244.623] IEnumWbemClassObject:Next (in: This=0x87e4b0, lTimeout=-1, uCount=0x1, apObjects=0x887c08, puReturned=0x2377cc4 | out: apObjects=0x887c08*=0x89b980, puReturned=0x2377cc4*=0x1) returned 0x0 [0245.806] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9b8 | out: ppvObject=0x19e9b8*=0x89b980) returned 0x0 [0245.806] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e974 | out: ppvObject=0x19e974*=0x0) returned 0x80004002 [0245.807] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e794 | out: ppvObject=0x19e794*=0x0) returned 0x80004002 [0245.807] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e56c | out: ppvObject=0x19e56c*=0x0) returned 0x80004002 [0245.807] IUnknown:AddRef (This=0x89b980) returned 0x3 [0245.807] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2d4 | out: ppvObject=0x19e2d4*=0x0) returned 0x80004002 [0245.807] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e284 | out: ppvObject=0x19e284*=0x0) returned 0x80004002 [0245.807] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e290 | out: ppvObject=0x19e290*=0x89b984) returned 0x0 [0245.807] IMarshal:GetUnmarshalClass (in: This=0x89b984, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e298 | out: pCid=0x19e298*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0245.807] IUnknown:Release (This=0x89b984) returned 0x3 [0245.807] CoGetContextToken (in: pToken=0x19e2f0 | out: pToken=0x19e2f0) returned 0x0 [0245.807] CoGetContextToken (in: pToken=0x19e6f8 | out: pToken=0x19e6f8) returned 0x0 [0245.807] IUnknown:QueryInterface (in: This=0x89b980, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e788 | out: ppvObject=0x19e788*=0x0) returned 0x80004002 [0245.807] IUnknown:Release (This=0x89b980) returned 0x2 [0245.807] CoGetContextToken (in: pToken=0x19ecc8 | out: pToken=0x19ecc8) returned 0x0 [0245.807] CoGetContextToken (in: pToken=0x19ec28 | out: pToken=0x19ec28) returned 0x0 [0245.808] IUnknown:QueryInterface (in: This=0x89b980, riid=0x19ecf8*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ecf4 | out: ppvObject=0x19ecf4*=0x89b980) returned 0x0 [0245.808] IUnknown:AddRef (This=0x89b980) returned 0x4 [0245.808] IUnknown:Release (This=0x89b980) returned 0x3 [0245.808] IUnknown:Release (This=0x89b980) returned 0x2 [0245.808] CoTaskMemFree (pv=0x887c08) [0245.808] CoGetContextToken (in: pToken=0x19f038 | out: pToken=0x19f038) returned 0x0 [0245.808] IUnknown:AddRef (This=0x89b980) returned 0x3 [0245.808] IWbemClassObject:Get (in: This=0x89b980, wszName="__GENUS", lFlags=0, pVal=0x19f348*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3c8*=0, plFlavor=0x19f3c4*=0 | out: pVal=0x19f348*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f3c8*=3, plFlavor=0x19f3c4*=64) returned 0x0 [0245.808] IWbemClassObject:Get (in: This=0x89b980, wszName="__PATH", lFlags=0, pVal=0x19f32c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3b0*=0, plFlavor=0x19f3ac*=0 | out: pVal=0x19f32c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x19f3b0*=8, plFlavor=0x19f3ac*=64) returned 0x0 [0245.809] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0245.809] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0245.809] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x440 [0245.809] SetEvent (hEvent=0x3b0) returned 1 [0245.809] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f304*=0x440, lpdwindex=0x19f124 | out: lpdwindex=0x19f124) returned 0x0 [0245.812] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0 [0245.813] CoGetContextToken (in: pToken=0x19f130 | out: pToken=0x19f130) returned 0x0 [0245.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x19f200*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x862df8) returned 0x0 [0245.813] WbemDefPath:IUnknown:AddRef (This=0x862df8) returned 0x3 [0245.813] WbemDefPath:IUnknown:Release (This=0x862df8) returned 0x2 [0245.813] WbemDefPath:IWbemPath:SetText (This=0x862df8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0245.813] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f384 | out: puCount=0x19f384*=0x2) returned 0x0 [0245.813] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f380*=0x0, pszText=0x0 | out: puBuffLength=0x19f380*=0xf, pszText=0x0) returned 0x0 [0245.813] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f380*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f380*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0245.818] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f354 | out: puCount=0x19f354*=0x2) returned 0x0 [0245.818] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f350*=0x0, pszText=0x0 | out: puBuffLength=0x19f350*=0xf, pszText=0x0) returned 0x0 [0245.818] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f350*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f350*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0245.818] IWbemClassObject:Get (in: This=0x89b980, wszName="Name", lFlags=0, pVal=0x19f350*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237852c*=0, plFlavor=0x2378530*=0 | out: pVal=0x19f350*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x237852c*=8, plFlavor=0x2378530*=0) returned 0x0 [0245.818] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0245.818] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0245.818] IWbemClassObject:Get (in: This=0x89b980, wszName="Name", lFlags=0, pVal=0x19f358*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237852c*=8, plFlavor=0x2378530*=0 | out: pVal=0x19f358*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x237852c*=8, plFlavor=0x2378530*=0) returned 0x0 [0245.818] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0245.818] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0245.818] CoTaskMemAlloc (cb=0x4) returned 0x83c560 [0245.818] IEnumWbemClassObject:Next (in: This=0x87e4b0, lTimeout=-1, uCount=0x1, apObjects=0x83c560, puReturned=0x2377cc4 | out: apObjects=0x83c560*=0x0, puReturned=0x2377cc4*=0x0) returned 0x1 [0245.820] CoTaskMemFree (pv=0x83c560) [0245.820] CoGetContextToken (in: pToken=0x19f280 | out: pToken=0x19f280) returned 0x0 [0245.820] WbemLocator:IUnknown:Release (This=0x89d808) returned 0x1 [0245.820] IUnknown:Release (This=0x87e4b0) returned 0x0 [0245.825] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f390 | out: puCount=0x19f390*=0x2) returned 0x0 [0245.825] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f38c*=0x0, pszText=0x0 | out: puBuffLength=0x19f38c*=0xf, pszText=0x0) returned 0x0 [0245.825] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f38c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f38c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0245.852] GlobalMemoryStatusEx (in: lpBuffer=0x2378768 | out: lpBuffer=0x2378768) returned 1 [0245.967] GetUserNameW (in: lpBuffer=0x19f1ac, pcbBuffer=0x2379660 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x2379660) returned 1 [0245.968] GetComputerNameW (in: lpBuffer=0x19f1ac, nSize=0x2379ba0 | out: lpBuffer="XC64ZB", nSize=0x2379ba0) returned 1 [0245.970] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f380 | out: puCount=0x19f380*=0x2) returned 0x0 [0245.970] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f37c*=0x0, pszText=0x0 | out: puBuffLength=0x19f37c*=0xf, pszText=0x0) returned 0x0 [0245.970] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f37c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f37c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0245.970] IWbemClassObject:Get (in: This=0x89bb18, wszName="Name", lFlags=0, pVal=0x19f37c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237a050*=0, plFlavor=0x237a054*=0 | out: pVal=0x19f37c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x237a050*=8, plFlavor=0x237a054*=0) returned 0x0 [0245.971] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0245.971] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0245.971] IWbemClassObject:Get (in: This=0x89bb18, wszName="Name", lFlags=0, pVal=0x19f384*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237a050*=8, plFlavor=0x237a054*=0 | out: pVal=0x19f384*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x237a050*=8, plFlavor=0x237a054*=0) returned 0x0 [0245.971] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0245.971] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0245.971] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f398 | out: puCount=0x19f398*=0x2) returned 0x0 [0245.971] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f394*=0x0, pszText=0x0 | out: puBuffLength=0x19f394*=0xf, pszText=0x0) returned 0x0 [0245.971] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f394*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f394*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0245.979] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f244*=0x3e4, lpdwindex=0x19f0f4 | out: lpdwindex=0x19f0f4) returned 0x0 [0245.995] CoGetContextToken (in: pToken=0x19f000 | out: pToken=0x19f000) returned 0x0 [0245.995] CoGetContextToken (in: pToken=0x19efa8 | out: pToken=0x19efa8) returned 0x0 [0245.995] IUnknown:QueryInterface (in: This=0x810138, riid=0x6b2e8724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef88 | out: ppvObject=0x19ef88*=0x810148) returned 0x0 [0245.996] CObjectContext::ContextCallback () returned 0x0 [0245.997] IUnknown:Release (This=0x810148) returned 0x1 [0245.997] CoUnmarshalInterface (in: pStm=0x8655d0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eff0 | out: ppv=0x19eff0*=0x89cf08) returned 0x0 [0245.998] CoMarshalInterface (pStm=0x8655d0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x89cf08, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0245.998] WbemLocator:IUnknown:QueryInterface (in: This=0x89cf08, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee94 | out: ppvObject=0x19ee94*=0x89cf08) returned 0x0 [0245.998] WbemLocator:IUnknown:QueryInterface (in: This=0x89cf08, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee50 | out: ppvObject=0x19ee50*=0x0) returned 0x80004002 [0245.999] WbemLocator:IUnknown:QueryInterface (in: This=0x89cf08, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec6c | out: ppvObject=0x19ec6c*=0x0) returned 0x80004002 [0245.999] WbemLocator:IUnknown:QueryInterface (in: This=0x89cf08, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea44 | out: ppvObject=0x19ea44*=0x0) returned 0x80004002 [0246.000] WbemLocator:IUnknown:AddRef (This=0x89cf08) returned 0x3 [0246.000] WbemLocator:IUnknown:QueryInterface (in: This=0x89cf08, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ac | out: ppvObject=0x19e7ac*=0x0) returned 0x80004002 [0246.000] WbemLocator:IUnknown:QueryInterface (in: This=0x89cf08, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e75c | out: ppvObject=0x19e75c*=0x0) returned 0x80004002 [0246.000] WbemLocator:IUnknown:QueryInterface (in: This=0x89cf08, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e768 | out: ppvObject=0x19e768*=0x89ce64) returned 0x0 [0246.000] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89ce64, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e770 | out: pCid=0x19e770*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0246.000] WbemLocator:IUnknown:Release (This=0x89ce64) returned 0x3 [0246.000] CoGetContextToken (in: pToken=0x19e7c8 | out: pToken=0x19e7c8) returned 0x0 [0246.000] CoGetContextToken (in: pToken=0x19ebd0 | out: pToken=0x19ebd0) returned 0x0 [0246.000] WbemLocator:IUnknown:QueryInterface (in: This=0x89cf08, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x89ceec) returned 0x0 [0246.000] WbemLocator:IRpcOptions:Query (in: This=0x89ceec, pPrx=0x89cf08, dwProperty=2, pdwValue=0x19ec88 | out: pdwValue=0x19ec88) returned 0x0 [0246.000] WbemLocator:IUnknown:Release (This=0x89ceec) returned 0x3 [0246.000] WbemLocator:IUnknown:Release (This=0x89cf08) returned 0x2 [0246.001] WbemLocator:IUnknown:Release (This=0x89cf08) returned 0x1 [0246.001] CoGetContextToken (in: pToken=0x19ef40 | out: pToken=0x19ef40) returned 0x0 [0246.001] WbemLocator:IUnknown:AddRef (This=0x89cf08) returned 0x2 [0246.001] WbemLocator:IUnknown:QueryInterface (in: This=0x89cf08, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x89cee4) returned 0x0 [0246.001] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89cee4, pProxy=0x89cf08, pAuthnSvc=0x19f24c, pAuthzSvc=0x19f248, pServerPrincName=0x19f240, pAuthnLevel=0x19f244, pImpLevel=0x19f234, pAuthInfo=0x19f238, pCapabilites=0x19f23c | out: pAuthnSvc=0x19f24c*=0xa, pAuthzSvc=0x19f248*=0x0, pServerPrincName=0x19f240, pAuthnLevel=0x19f244*=0x6, pImpLevel=0x19f234*=0x2, pAuthInfo=0x19f238, pCapabilites=0x19f23c*=0x1) returned 0x0 [0246.001] WbemLocator:IUnknown:Release (This=0x89cee4) returned 0x2 [0246.001] WbemLocator:IUnknown:QueryInterface (in: This=0x89cf08, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f0 | out: ppvObject=0x19f1f0*=0x89cf08) returned 0x0 [0246.001] WbemLocator:IUnknown:QueryInterface (in: This=0x89cf08, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1ec | out: ppvObject=0x19f1ec*=0x89cee4) returned 0x0 [0246.001] WbemLocator:IClientSecurity:SetBlanket (This=0x89cee4, pProxy=0x89cf08, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0246.001] WbemLocator:IUnknown:Release (This=0x89cee4) returned 0x3 [0246.001] WbemLocator:IUnknown:Release (This=0x89cf08) returned 0x2 [0246.001] CoTaskMemFree (pv=0x888390) [0246.002] WbemLocator:IUnknown:Release (This=0x89cf08) returned 0x1 [0246.002] SysStringLen (param_1=0x0) returned 0x0 [0246.002] CoGetContextToken (in: pToken=0x19f1b8 | out: pToken=0x19f1b8) returned 0x0 [0246.002] CoGetContextToken (in: pToken=0x19f118 | out: pToken=0x19f118) returned 0x0 [0246.002] WbemLocator:IUnknown:QueryInterface (in: This=0x89cf08, riid=0x19f1e8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f1e4 | out: ppvObject=0x19f1e4*=0x8a3d18) returned 0x0 [0246.002] WbemLocator:IUnknown:AddRef (This=0x8a3d18) returned 0x3 [0246.002] WbemLocator:IUnknown:Release (This=0x8a3d18) returned 0x2 [0246.002] CoGetContextToken (in: pToken=0x19f178 | out: pToken=0x19f178) returned 0x0 [0246.003] WbemLocator:IUnknown:AddRef (This=0x8a3d18) returned 0x3 [0246.003] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3d18, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x89cee4) returned 0x0 [0246.003] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89cee4, pProxy=0x8a3d18, pAuthnSvc=0x19f24c, pAuthzSvc=0x19f248, pServerPrincName=0x19f240, pAuthnLevel=0x19f244, pImpLevel=0x19f234, pAuthInfo=0x19f238, pCapabilites=0x19f23c | out: pAuthnSvc=0x19f24c*=0xa, pAuthzSvc=0x19f248*=0x0, pServerPrincName=0x19f240, pAuthnLevel=0x19f244*=0x6, pImpLevel=0x19f234*=0x2, pAuthInfo=0x19f238, pCapabilites=0x19f23c*=0x1) returned 0x0 [0246.003] WbemLocator:IUnknown:Release (This=0x89cee4) returned 0x3 [0246.003] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3d18, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1f0 | out: ppvObject=0x19f1f0*=0x89cf08) returned 0x0 [0246.003] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3d18, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1ec | out: ppvObject=0x19f1ec*=0x89cee4) returned 0x0 [0246.003] WbemLocator:IClientSecurity:SetBlanket (This=0x89cee4, pProxy=0x8a3d18, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0246.003] WbemLocator:IUnknown:Release (This=0x89cee4) returned 0x4 [0246.003] WbemLocator:IUnknown:Release (This=0x89cf08) returned 0x3 [0246.003] CoTaskMemFree (pv=0x887f40) [0246.003] WbemLocator:IUnknown:Release (This=0x8a3d18) returned 0x2 [0246.003] SysStringLen (param_1=0x0) returned 0x0 [0246.004] CoGetContextToken (in: pToken=0x19f0f8 | out: pToken=0x19f0f8) returned 0x0 [0246.004] WbemLocator:IUnknown:AddRef (This=0x8a3d18) returned 0x3 [0246.004] IWbemServices:ExecQuery (in: This=0x8a3d18, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x19f308 | out: ppEnum=0x19f308*=0x87e0c8) returned 0x0 [0246.096] IUnknown:QueryInterface (in: This=0x87e0c8, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f16c | out: ppvObject=0x19f16c*=0x87e0cc) returned 0x0 [0246.096] IClientSecurity:QueryBlanket (in: This=0x87e0cc, pProxy=0x87e0c8, pAuthnSvc=0x19f1bc, pAuthzSvc=0x19f1b8, pServerPrincName=0x19f1b0, pAuthnLevel=0x19f1b4, pImpLevel=0x19f1a4, pAuthInfo=0x19f1a8, pCapabilites=0x19f1ac | out: pAuthnSvc=0x19f1bc*=0xa, pAuthzSvc=0x19f1b8*=0x0, pServerPrincName=0x19f1b0, pAuthnLevel=0x19f1b4*=0x6, pImpLevel=0x19f1a4*=0x2, pAuthInfo=0x19f1a8, pCapabilites=0x19f1ac*=0x1) returned 0x0 [0246.096] IUnknown:Release (This=0x87e0cc) returned 0x1 [0246.096] IUnknown:QueryInterface (in: This=0x87e0c8, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f160 | out: ppvObject=0x19f160*=0x89cb08) returned 0x0 [0246.096] IUnknown:QueryInterface (in: This=0x87e0c8, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f15c | out: ppvObject=0x19f15c*=0x87e0cc) returned 0x0 [0246.097] IClientSecurity:SetBlanket (This=0x87e0cc, pProxy=0x87e0c8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0246.098] IUnknown:Release (This=0x87e0cc) returned 0x2 [0246.098] WbemLocator:IUnknown:Release (This=0x89cb08) returned 0x1 [0246.098] CoTaskMemFree (pv=0x888210) [0246.099] IUnknown:QueryInterface (in: This=0x87e0c8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed58 | out: ppvObject=0x19ed58*=0x89cb08) returned 0x0 [0246.099] WbemLocator:IUnknown:QueryInterface (in: This=0x89cb08, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ed14 | out: ppvObject=0x19ed14*=0x0) returned 0x80004002 [0246.099] WbemLocator:IUnknown:QueryInterface (in: This=0x89cb08, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eb34 | out: ppvObject=0x19eb34*=0x0) returned 0x80004002 [0246.100] IUnknown:QueryInterface (in: This=0x87e0c8, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e90c | out: ppvObject=0x19e90c*=0x0) returned 0x80004002 [0246.100] WbemLocator:IUnknown:AddRef (This=0x89cb08) returned 0x3 [0246.100] WbemLocator:IUnknown:QueryInterface (in: This=0x89cb08, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e674 | out: ppvObject=0x19e674*=0x0) returned 0x80004002 [0246.100] WbemLocator:IUnknown:QueryInterface (in: This=0x89cb08, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e624 | out: ppvObject=0x19e624*=0x0) returned 0x80004002 [0246.100] WbemLocator:IUnknown:QueryInterface (in: This=0x89cb08, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e630 | out: ppvObject=0x19e630*=0x89ca64) returned 0x0 [0246.100] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89ca64, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e638 | out: pCid=0x19e638*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0246.100] WbemLocator:IUnknown:Release (This=0x89ca64) returned 0x3 [0246.100] CoGetContextToken (in: pToken=0x19e690 | out: pToken=0x19e690) returned 0x0 [0246.101] CoGetContextToken (in: pToken=0x19ea98 | out: pToken=0x19ea98) returned 0x0 [0246.101] WbemLocator:IUnknown:QueryInterface (in: This=0x89cb08, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eb28 | out: ppvObject=0x19eb28*=0x89caec) returned 0x0 [0246.101] WbemLocator:IRpcOptions:Query (in: This=0x89caec, pPrx=0x89cb08, dwProperty=2, pdwValue=0x19eb50 | out: pdwValue=0x19eb50) returned 0x80004002 [0246.101] WbemLocator:IUnknown:Release (This=0x89caec) returned 0x3 [0246.101] WbemLocator:IUnknown:Release (This=0x89cb08) returned 0x2 [0246.101] CoGetContextToken (in: pToken=0x19f068 | out: pToken=0x19f068) returned 0x0 [0246.101] CoGetContextToken (in: pToken=0x19efc8 | out: pToken=0x19efc8) returned 0x0 [0246.101] WbemLocator:IUnknown:QueryInterface (in: This=0x89cb08, riid=0x19f098*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f094 | out: ppvObject=0x19f094*=0x87e0c8) returned 0x0 [0246.101] IUnknown:AddRef (This=0x87e0c8) returned 0x4 [0246.101] IUnknown:Release (This=0x87e0c8) returned 0x3 [0246.101] IUnknown:Release (This=0x87e0c8) returned 0x2 [0246.101] WbemLocator:IUnknown:Release (This=0x8a3d18) returned 0x2 [0246.101] SysStringLen (param_1=0x0) returned 0x0 [0246.101] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f354 | out: puCount=0x19f354*=0x2) returned 0x0 [0246.101] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f350*=0x0, pszText=0x0 | out: puBuffLength=0x19f350*=0xf, pszText=0x0) returned 0x0 [0246.101] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f350*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f350*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0246.101] CoGetContextToken (in: pToken=0x19f1a0 | out: pToken=0x19f1a0) returned 0x0 [0246.101] IUnknown:AddRef (This=0x87e0c8) returned 0x3 [0246.101] IEnumWbemClassObject:Clone (in: This=0x87e0c8, ppEnum=0x19f360 | out: ppEnum=0x19f360*=0x87e708) returned 0x0 [0246.103] IUnknown:QueryInterface (in: This=0x87e708, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f224 | out: ppvObject=0x19f224*=0x87e70c) returned 0x0 [0246.103] IClientSecurity:QueryBlanket (in: This=0x87e70c, pProxy=0x87e708, pAuthnSvc=0x19f274, pAuthzSvc=0x19f270, pServerPrincName=0x19f268, pAuthnLevel=0x19f26c, pImpLevel=0x19f25c, pAuthInfo=0x19f260, pCapabilites=0x19f264 | out: pAuthnSvc=0x19f274*=0xa, pAuthzSvc=0x19f270*=0x0, pServerPrincName=0x19f268, pAuthnLevel=0x19f26c*=0x6, pImpLevel=0x19f25c*=0x2, pAuthInfo=0x19f260, pCapabilites=0x19f264*=0x1) returned 0x0 [0246.103] IUnknown:Release (This=0x87e70c) returned 0x1 [0246.103] IUnknown:QueryInterface (in: This=0x87e708, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f218 | out: ppvObject=0x19f218*=0x89d808) returned 0x0 [0246.103] IUnknown:QueryInterface (in: This=0x87e708, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x87e70c) returned 0x0 [0246.103] IClientSecurity:SetBlanket (This=0x87e70c, pProxy=0x87e708, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0246.105] IUnknown:Release (This=0x87e70c) returned 0x2 [0246.105] WbemLocator:IUnknown:Release (This=0x89d808) returned 0x1 [0246.105] CoTaskMemFree (pv=0x888510) [0246.105] IUnknown:QueryInterface (in: This=0x87e708, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee00 | out: ppvObject=0x19ee00*=0x89d808) returned 0x0 [0246.105] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edbc | out: ppvObject=0x19edbc*=0x0) returned 0x80004002 [0246.106] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ebdc | out: ppvObject=0x19ebdc*=0x0) returned 0x80004002 [0246.106] IUnknown:QueryInterface (in: This=0x87e708, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9b4 | out: ppvObject=0x19e9b4*=0x0) returned 0x80004002 [0246.106] WbemLocator:IUnknown:AddRef (This=0x89d808) returned 0x3 [0246.106] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e71c | out: ppvObject=0x19e71c*=0x0) returned 0x80004002 [0246.106] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6cc | out: ppvObject=0x19e6cc*=0x0) returned 0x80004002 [0246.107] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6d8 | out: ppvObject=0x19e6d8*=0x89d764) returned 0x0 [0246.107] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89d764, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e6e0 | out: pCid=0x19e6e0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0246.107] WbemLocator:IUnknown:Release (This=0x89d764) returned 0x3 [0246.107] CoGetContextToken (in: pToken=0x19e738 | out: pToken=0x19e738) returned 0x0 [0246.107] CoGetContextToken (in: pToken=0x19eb40 | out: pToken=0x19eb40) returned 0x0 [0246.107] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebd0 | out: ppvObject=0x19ebd0*=0x89d7ec) returned 0x0 [0246.107] WbemLocator:IRpcOptions:Query (in: This=0x89d7ec, pPrx=0x89d808, dwProperty=2, pdwValue=0x19ebf8 | out: pdwValue=0x19ebf8) returned 0x80004002 [0246.107] WbemLocator:IUnknown:Release (This=0x89d7ec) returned 0x3 [0246.107] WbemLocator:IUnknown:Release (This=0x89d808) returned 0x2 [0246.107] CoGetContextToken (in: pToken=0x19f110 | out: pToken=0x19f110) returned 0x0 [0246.107] CoGetContextToken (in: pToken=0x19f070 | out: pToken=0x19f070) returned 0x0 [0246.107] WbemLocator:IUnknown:QueryInterface (in: This=0x89d808, riid=0x19f140*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f13c | out: ppvObject=0x19f13c*=0x87e708) returned 0x0 [0246.107] IUnknown:AddRef (This=0x87e708) returned 0x4 [0246.107] IUnknown:Release (This=0x87e708) returned 0x3 [0246.107] IUnknown:Release (This=0x87e708) returned 0x2 [0246.107] IUnknown:Release (This=0x87e0c8) returned 0x2 [0246.107] SysStringLen (param_1=0x0) returned 0x0 [0246.108] IEnumWbemClassObject:Reset (This=0x87e708) returned 0x0 [0246.146] CoTaskMemAlloc (cb=0x4) returned 0x83c300 [0246.146] IEnumWbemClassObject:Next (in: This=0x87e708, lTimeout=-1, uCount=0x1, apObjects=0x83c300, puReturned=0x237af64 | out: apObjects=0x83c300*=0x89aff0, puReturned=0x237af64*=0x1) returned 0x0 [0247.189] IUnknown:QueryInterface (in: This=0x89aff0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9c0 | out: ppvObject=0x19e9c0*=0x89aff0) returned 0x0 [0247.190] IUnknown:QueryInterface (in: This=0x89aff0, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e97c | out: ppvObject=0x19e97c*=0x0) returned 0x80004002 [0247.190] IUnknown:QueryInterface (in: This=0x89aff0, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e79c | out: ppvObject=0x19e79c*=0x0) returned 0x80004002 [0247.190] IUnknown:QueryInterface (in: This=0x89aff0, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e574 | out: ppvObject=0x19e574*=0x0) returned 0x80004002 [0247.190] IUnknown:AddRef (This=0x89aff0) returned 0x3 [0247.190] IUnknown:QueryInterface (in: This=0x89aff0, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2dc | out: ppvObject=0x19e2dc*=0x0) returned 0x80004002 [0247.190] IUnknown:QueryInterface (in: This=0x89aff0, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e28c | out: ppvObject=0x19e28c*=0x0) returned 0x80004002 [0247.190] IUnknown:QueryInterface (in: This=0x89aff0, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e298 | out: ppvObject=0x19e298*=0x89aff4) returned 0x0 [0247.190] IMarshal:GetUnmarshalClass (in: This=0x89aff4, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e2a0 | out: pCid=0x19e2a0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0247.190] IUnknown:Release (This=0x89aff4) returned 0x3 [0247.190] CoGetContextToken (in: pToken=0x19e2f8 | out: pToken=0x19e2f8) returned 0x0 [0247.190] CoGetContextToken (in: pToken=0x19e700 | out: pToken=0x19e700) returned 0x0 [0247.190] IUnknown:QueryInterface (in: This=0x89aff0, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e790 | out: ppvObject=0x19e790*=0x0) returned 0x80004002 [0247.191] IUnknown:Release (This=0x89aff0) returned 0x2 [0247.191] CoGetContextToken (in: pToken=0x19ecd0 | out: pToken=0x19ecd0) returned 0x0 [0247.191] CoGetContextToken (in: pToken=0x19ec30 | out: pToken=0x19ec30) returned 0x0 [0247.191] IUnknown:QueryInterface (in: This=0x89aff0, riid=0x19ed00*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ecfc | out: ppvObject=0x19ecfc*=0x89aff0) returned 0x0 [0247.191] IUnknown:AddRef (This=0x89aff0) returned 0x4 [0247.191] IUnknown:Release (This=0x89aff0) returned 0x3 [0247.191] IUnknown:Release (This=0x89aff0) returned 0x2 [0247.191] CoTaskMemFree (pv=0x83c300) [0247.191] CoGetContextToken (in: pToken=0x19f040 | out: pToken=0x19f040) returned 0x0 [0247.191] IUnknown:AddRef (This=0x89aff0) returned 0x3 [0247.191] IWbemClassObject:Get (in: This=0x89aff0, wszName="__GENUS", lFlags=0, pVal=0x19f350*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3d0*=0, plFlavor=0x19f3cc*=0 | out: pVal=0x19f350*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f3d0*=3, plFlavor=0x19f3cc*=64) returned 0x0 [0247.191] IWbemClassObject:Get (in: This=0x89aff0, wszName="__PATH", lFlags=0, pVal=0x19f334*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3b8*=0, plFlavor=0x19f3b4*=0 | out: pVal=0x19f334*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x19f3b8*=8, plFlavor=0x19f3b4*=64) returned 0x0 [0247.191] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0247.191] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0247.192] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3e0 [0247.192] SetEvent (hEvent=0x3b0) returned 1 [0247.192] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f30c*=0x3e0, lpdwindex=0x19f12c | out: lpdwindex=0x19f12c) returned 0x0 [0247.195] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0 [0247.195] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0 [0247.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x863178, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x863178) returned 0x0 [0247.196] WbemDefPath:IUnknown:AddRef (This=0x863178) returned 0x3 [0247.196] WbemDefPath:IUnknown:Release (This=0x863178) returned 0x2 [0247.196] WbemDefPath:IWbemPath:SetText (This=0x863178, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0247.196] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f38c | out: puCount=0x19f38c*=0x2) returned 0x0 [0247.196] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f388*=0x0, pszText=0x0 | out: puBuffLength=0x19f388*=0xf, pszText=0x0) returned 0x0 [0247.196] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f388*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f388*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0247.196] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f35c | out: puCount=0x19f35c*=0x2) returned 0x0 [0247.196] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f358*=0x0, pszText=0x0 | out: puBuffLength=0x19f358*=0xf, pszText=0x0) returned 0x0 [0247.196] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f358*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f358*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0247.196] IWbemClassObject:Get (in: This=0x89aff0, wszName="Name", lFlags=0, pVal=0x19f358*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237b7b4*=0, plFlavor=0x237b7b8*=0 | out: pVal=0x19f358*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x237b7b4*=8, plFlavor=0x237b7b8*=0) returned 0x0 [0247.196] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0247.196] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0247.196] IWbemClassObject:Get (in: This=0x89aff0, wszName="Name", lFlags=0, pVal=0x19f360*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237b7b4*=8, plFlavor=0x237b7b8*=0 | out: pVal=0x19f360*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x237b7b4*=8, plFlavor=0x237b7b8*=0) returned 0x0 [0247.196] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0247.197] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0247.197] CoTaskMemAlloc (cb=0x4) returned 0x83c300 [0247.197] IEnumWbemClassObject:Next (in: This=0x87e708, lTimeout=-1, uCount=0x1, apObjects=0x83c300, puReturned=0x237af64 | out: apObjects=0x83c300*=0x0, puReturned=0x237af64*=0x0) returned 0x1 [0247.198] CoTaskMemFree (pv=0x83c300) [0247.198] CoGetContextToken (in: pToken=0x19f288 | out: pToken=0x19f288) returned 0x0 [0247.198] WbemLocator:IUnknown:Release (This=0x89d808) returned 0x1 [0247.198] IUnknown:Release (This=0x87e708) returned 0x0 [0247.200] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x19f398 | out: puCount=0x19f398*=0x2) returned 0x0 [0247.201] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f394*=0x0, pszText=0x0 | out: puBuffLength=0x19f394*=0xf, pszText=0x0) returned 0x0 [0247.201] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=4, puBuffLength=0x19f394*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f394*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0247.201] GlobalMemoryStatusEx (in: lpBuffer=0x237bd40 | out: lpBuffer=0x237bd40) returned 1 [0247.355] GetCurrentProcess () returned 0xffffffff [0247.355] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef24 | out: TokenHandle=0x19ef24*=0x3f0) returned 1 [0247.359] GetCurrentProcess () returned 0xffffffff [0247.359] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef38 | out: TokenHandle=0x19ef38*=0x464) returned 1 [0247.363] QueryPerformanceFrequency (in: lpFrequency=0x595d30 | out: lpFrequency=0x595d30*=100000000) returned 1 [0247.364] QueryPerformanceCounter (in: lpPerformanceCount=0x19f340 | out: lpPerformanceCount=0x19f340*=3184051189861) returned 1 [0247.371] GetCurrentProcess () returned 0xffffffff [0247.371] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eef4 | out: TokenHandle=0x19eef4*=0x248) returned 1 [0247.377] GetCurrentProcess () returned 0xffffffff [0247.377] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef08 | out: TokenHandle=0x19ef08*=0x430) returned 1 [0247.396] GetCurrentProcess () returned 0xffffffff [0247.396] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef08 | out: TokenHandle=0x19ef08*=0x24c) returned 1 [0247.399] GetCurrentProcess () returned 0xffffffff [0247.399] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef1c | out: TokenHandle=0x19ef1c*=0x250) returned 1 [0247.406] GetCurrentProcess () returned 0xffffffff [0247.406] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f228 | out: TokenHandle=0x19f228*=0x434) returned 1 [0248.091] CoTaskMemAlloc (cb=0xcc0) returned 0x8bd080 [0248.091] RasEnumConnectionsW (in: param_1=0x8bd080, param_2=0x19f238, param_3=0x19f23c | out: param_1=0x8bd080, param_2=0x19f238, param_3=0x19f23c) returned 0x0 [0248.319] CoTaskMemFree (pv=0x8bd080) [0248.326] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19f020 | out: lpWSAData=0x19f020) returned 0 [0248.336] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x544 [0248.699] setsockopt (s=0x544, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0248.699] closesocket (s=0x544) returned 0 [0248.699] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x544 [0248.701] setsockopt (s=0x544, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0248.701] closesocket (s=0x544) returned 0 [0248.701] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x544 [0248.701] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x548 [0248.702] ioctlsocket (in: s=0x544, cmd=-2147195266, argp=0x19f240 | out: argp=0x19f240) returned 0 [0248.702] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x54c [0248.702] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x550 [0248.702] ioctlsocket (in: s=0x54c, cmd=-2147195266, argp=0x19f240 | out: argp=0x19f240) returned 0 [0248.703] WSAIoctl (in: s=0x544, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19f228, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19f228, lpOverlapped=0x0) returned -1 [0248.704] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ef58, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0248.710] WSAEventSelect (s=0x544, hEventObject=0x548, lNetworkEvents=512) returned 0 [0248.710] WSAIoctl (in: s=0x54c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19f228, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19f228, lpOverlapped=0x0) returned -1 [0248.710] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ef58, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0248.710] WSAEventSelect (s=0x54c, hEventObject=0x550, lNetworkEvents=512) returned 0 [0248.710] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x554 [0248.711] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x554, param_3=0x3) returned 0x0 [0248.719] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x19f254 | out: phkResult=0x19f254*=0x56c) returned 0x0 [0248.720] RegOpenKeyExW (in: hKey=0x56c, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f204 | out: phkResult=0x19f204*=0x570) returned 0x0 [0248.720] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x574 [0248.720] RegNotifyChangeKeyValue (hKey=0x570, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x574, fAsynchronous=1) returned 0x0 [0248.721] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f208 | out: phkResult=0x19f208*=0x578) returned 0x0 [0248.722] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x57c [0248.722] RegNotifyChangeKeyValue (hKey=0x578, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x57c, fAsynchronous=1) returned 0x0 [0248.722] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f208 | out: phkResult=0x19f208*=0x580) returned 0x0 [0248.722] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x584 [0248.722] RegNotifyChangeKeyValue (hKey=0x580, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x584, fAsynchronous=1) returned 0x0 [0248.723] GetCurrentProcess () returned 0xffffffff [0248.723] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f1fc | out: TokenHandle=0x19f1fc*=0x588) returned 1 [0248.726] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb08 | out: phkResult=0x19eb08*=0x58c) returned 0x0 [0248.726] RegQueryValueExW (in: hKey=0x58c, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x19eb24, lpData=0x0, lpcbData=0x19eb20*=0x0 | out: lpType=0x19eb24*=0x0, lpData=0x0, lpcbData=0x19eb20*=0x0) returned 0x2 [0248.726] RegCloseKey (hKey=0x58c) returned 0x0 [0249.117] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x8c05b0 [0249.765] WinHttpSetTimeouts (hInternet=0x8c05b0, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0249.766] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x19f208 | out: pProxyConfig=0x19f208) returned 1 [0250.275] CoTaskMemAlloc (cb=0x20c) returned 0x8639e8 [0250.275] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x8639e8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0250.276] CoTaskMemFree (pv=0x8639e8) [0250.276] CoTaskMemAlloc (cb=0x20c) returned 0x8639e8 [0250.276] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x8639e8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0250.276] CoTaskMemFree (pv=0x8639e8) [0250.279] EtwEventRegister (in: ProviderId=0x2385ce8, EnableCallback=0x47305fe, CallbackContext=0x0, RegHandle=0x2385cc4 | out: RegHandle=0x2385cc4) returned 0x0 [0250.279] EtwEventSetInformation (RegHandle=0x8c2a00, InformationClass=0x57, EventInformation=0x2, InformationLength=0x2385c84) returned 0x0 [0250.282] GetCurrentProcess () returned 0xffffffff [0250.282] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eed0 | out: TokenHandle=0x19eed0*=0x5d0) returned 1 [0250.284] GetCurrentProcess () returned 0xffffffff [0250.284] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eee4 | out: TokenHandle=0x19eee4*=0x5d4) returned 1 [0250.363] SystemFunction041 (in: Memory=0x83baac, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x83baac) returned 0x0 [0250.399] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19f17c*=0x554, lpdwindex=0x19ef9c | out: lpdwindex=0x19ef9c) returned 0x80010115 [0250.400] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19f15c*=0x548, lpdwindex=0x19ef7c | out: lpdwindex=0x19ef7c) returned 0x80010115 [0250.400] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19f15c*=0x550, lpdwindex=0x19ef7c | out: lpdwindex=0x19ef7c) returned 0x80010115 [0250.400] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19f1b0*=0x574, lpdwindex=0x19efcc | out: lpdwindex=0x19efcc) returned 0x80010115 [0250.401] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19f1b0*=0x57c, lpdwindex=0x19efcc | out: lpdwindex=0x19efcc) returned 0x80010115 [0250.401] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19f1b0*=0x584, lpdwindex=0x19efcc | out: lpdwindex=0x19efcc) returned 0x80010115 [0250.406] GetCurrentProcess () returned 0xffffffff [0250.406] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ee4c | out: TokenHandle=0x19ee4c*=0x5d8) returned 1 [0250.407] GetCurrentProcess () returned 0xffffffff [0250.407] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ee60 | out: TokenHandle=0x19ee60*=0x5dc) returned 1 [0250.408] SetEvent (hEvent=0x230) returned 1 [0250.421] SetEvent (hEvent=0x230) returned 1 [0250.422] GetACP () returned 0x4e4 [0250.714] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x19f1c0 | out: pFixedInfo=0x0, pOutBufLen=0x19f1c0) returned 0x6f [0251.179] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x8a26f0 [0251.179] GetNetworkParams (in: pFixedInfo=0x8a26f0, pOutBufLen=0x19f1c0 | out: pFixedInfo=0x8a26f0, pOutBufLen=0x19f1c0) returned 0x0 [0251.193] LocalFree (hMem=0x8a26f0) returned 0x0 [0251.195] CoTaskMemAlloc (cb=0x20c) returned 0x8a4990 [0251.195] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x8a4990, nSize=0x104 | out: lpBuffer="") returned 0x0 [0251.195] CoTaskMemFree (pv=0x8a4990) [0251.195] CoTaskMemAlloc (cb=0x20c) returned 0x8a4990 [0251.195] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x8a4990, nSize=0x104 | out: lpBuffer="") returned 0x0 [0251.195] CoTaskMemFree (pv=0x8a4990) [0251.204] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x634 [0251.206] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x60c [0251.208] GetAddrInfoW (in: pNodeName="api.telegram.org", pServiceName=0x0, pHints=0x19f0b0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x19f058 | out: ppResult=0x19f058*=0x880398*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="api.telegram.org", ai_addr=0x88eb88*(sa_family=2, sin_port=0x0, sin_addr="149.154.167.220"), ai_next=0x0)) returned 0 [0251.812] FreeAddrInfoW (pAddrInfo=0x880398*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="api.telegram.org", ai_addr=0x88eb88*(sa_family=2, sin_port=0x0, sin_addr="149.154.167.220"), ai_next=0x0)) [0251.985] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x63c [0251.986] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x644 [0251.986] ioctlsocket (in: s=0x63c, cmd=-2147195266, argp=0x19f088 | out: argp=0x19f088) returned 0 [0251.986] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x648 [0251.987] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x64c [0251.987] ioctlsocket (in: s=0x648, cmd=-2147195266, argp=0x19f088 | out: argp=0x19f088) returned 0 [0251.987] WSAIoctl (in: s=0x63c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19f070, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19f070, lpOverlapped=0x0) returned -1 [0251.987] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19eda0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0251.988] WSAEventSelect (s=0x63c, hEventObject=0x644, lNetworkEvents=512) returned 0 [0251.988] WSAIoctl (in: s=0x648, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19f070, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19f070, lpOverlapped=0x0) returned -1 [0251.988] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19eda0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0251.988] WSAEventSelect (s=0x648, hEventObject=0x64c, lNetworkEvents=512) returned 0 [0251.989] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x19f06c*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x19f06c*=0xa80) returned 0x6f [0251.999] LocalAlloc (uFlags=0x0, uBytes=0xa80) returned 0x8aa1a8 [0251.999] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x8aa1a8, SizePointer=0x19f06c*=0xa80 | out: AdapterAddresses=0x8aa1a8*(Alignment=0x700000178, Length=0x178, IfIndex=0x7, Next=0x8aa458, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x8aa3cc, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x58, [1]=0xbc, [2]=0x27, [3]=0xf7, [4]=0xcc, [5]=0x54, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x7, ZoneIndices=([0]=0x7, [1]=0x7, [2]=0x7, [3]=0x7, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x8aa320*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x19f06c*=0xa80) returned 0x0 [0252.016] LocalFree (hMem=0x8aa1a8) returned 0x0 [0252.018] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f07c | out: phkResult=0x19f07c*=0x650) returned 0x0 [0252.019] RegQueryValueExW (in: hKey=0x650, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x19f098, lpData=0x0, lpcbData=0x19f094*=0x0 | out: lpType=0x19f098*=0x0, lpData=0x0, lpcbData=0x19f094*=0x0) returned 0x2 [0252.019] RegCloseKey (hKey=0x650) returned 0x0 [0252.020] WSAConnect (in: s=0x634, name=0x2392924*(sa_family=2, sin_port=0x1bb, sin_addr="149.154.167.220"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0252.040] closesocket (s=0x60c) returned 0 [0252.203] EnumerateSecurityPackagesW (in: pcPackages=0x19f164, ppPackageInfo=0x19f0f8 | out: pcPackages=0x19f164, ppPackageInfo=0x19f0f8) returned 0x0 [0252.214] FreeContextBuffer (in: pvContextBuffer=0x8aa1a8 | out: pvContextBuffer=0x8aa1a8) returned 0x0 [0252.223] GetCurrentProcess () returned 0xffffffff [0252.223] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef44 | out: TokenHandle=0x19ef44*=0x650) returned 1 [0252.225] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x23948ac, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x19ef98, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x2395da4, ptsExpiry=0x19ef1c | out: phCredential=0x2395da4, ptsExpiry=0x19ef1c) returned 0x0 [0252.646] InitializeSecurityContextW (in: phCredential=0x19ef5c, phContext=0x0, pTargetName=0x2392a1c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x2395fa8, pOutput=0x2395f40, pfContextAttr=0x2394880, ptsExpiry=0x19ef54 | out: phNewContext=0x2395fa8, pOutput=0x2395f40, pfContextAttr=0x2394880, ptsExpiry=0x19ef54) returned 0x90312 [0252.648] FreeContextBuffer (in: pvContextBuffer=0x8c38a0 | out: pvContextBuffer=0x8c38a0) returned 0x0 [0252.728] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74580000 [0252.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="GetCurrentPackageId", cchWideChar=19, lpMultiByteStr=0x19efa4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentPackageIdÍ`ÏÚkÀ<ÓÍ «\"khö\x19", lpUsedDefaultChar=0x0) returned 19 [0252.729] GetProcAddress (hModule=0x74580000, lpProcName="GetCurrentPackageId") returned 0x774dded0 [0252.732] GetCurrentPackageId () returned 0x3d54 [0252.734] send (s=0x634, buf=0x2395fbc*, len=184, flags=0) returned 184 [0252.736] recv (in: s=0x634, buf=0x2395fbc, len=5, flags=0 | out: buf=0x2395fbc*) returned 5 [0252.760] recv (in: s=0x634, buf=0x2395fc1, len=69, flags=0 | out: buf=0x2395fc1*) returned 69 [0252.761] InitializeSecurityContextW (in: phCredential=0x19eec0, phContext=0x19ef4c, pTargetName=0x2392a1c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2396398, Reserved2=0x0, phNewContext=0x2395fa8, pOutput=0x23963ac, pfContextAttr=0x2394880, ptsExpiry=0x19eeb8 | out: phNewContext=0x2395fa8, pOutput=0x23963ac, pfContextAttr=0x2394880, ptsExpiry=0x19eeb8) returned 0x90312 [0252.763] recv (in: s=0x634, buf=0x239643c, len=5, flags=0 | out: buf=0x239643c*) returned 5 [0252.763] recv (in: s=0x634, buf=0x2396455, len=5131, flags=0 | out: buf=0x2396455*) returned 5131 [0252.763] InitializeSecurityContextW (in: phCredential=0x19ee28, phContext=0x19eeb4, pTargetName=0x2392a1c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x23978d0, Reserved2=0x0, phNewContext=0x2395fa8, pOutput=0x23978e4, pfContextAttr=0x2394880, ptsExpiry=0x19ee20 | out: phNewContext=0x2395fa8, pOutput=0x23978e4, pfContextAttr=0x2394880, ptsExpiry=0x19ee20) returned 0x90312 [0252.768] recv (in: s=0x634, buf=0x2397974, len=5, flags=0 | out: buf=0x2397974*) returned 5 [0252.768] recv (in: s=0x634, buf=0x239798d, len=333, flags=0 | out: buf=0x239798d*) returned 333 [0252.768] InitializeSecurityContextW (in: phCredential=0x19ed90, phContext=0x19ee1c, pTargetName=0x2392a1c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2397b4c, Reserved2=0x0, phNewContext=0x2395fa8, pOutput=0x2397b60, pfContextAttr=0x2394880, ptsExpiry=0x19ed88 | out: phNewContext=0x2395fa8, pOutput=0x2397b60, pfContextAttr=0x2394880, ptsExpiry=0x19ed88) returned 0x90312 [0252.769] recv (in: s=0x634, buf=0x2397bf0, len=5, flags=0 | out: buf=0x2397bf0*) returned 5 [0252.769] recv (in: s=0x634, buf=0x2397c09, len=4, flags=0 | out: buf=0x2397c09*) returned 4 [0252.769] InitializeSecurityContextW (in: phCredential=0x19ecf8, phContext=0x19ed84, pTargetName=0x2392a1c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2397c80, Reserved2=0x0, phNewContext=0x2395fa8, pOutput=0x2397c94, pfContextAttr=0x2394880, ptsExpiry=0x19ecf0 | out: phNewContext=0x2395fa8, pOutput=0x2397c94, pfContextAttr=0x2394880, ptsExpiry=0x19ecf0) returned 0x90312 [0252.796] FreeContextBuffer (in: pvContextBuffer=0x8399a8 | out: pvContextBuffer=0x8399a8) returned 0x0 [0252.796] send (s=0x634, buf=0x2397d10*, len=126, flags=0) returned 126 [0252.797] recv (in: s=0x634, buf=0x2397d10, len=5, flags=0 | out: buf=0x2397d10*) returned 5 [0252.815] recv (in: s=0x634, buf=0x2397db5, len=218, flags=0 | out: buf=0x2397db5*) returned 218 [0252.815] InitializeSecurityContextW (in: phCredential=0x19ec60, phContext=0x19ecec, pTargetName=0x2392a1c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2397f00, Reserved2=0x0, phNewContext=0x2395fa8, pOutput=0x2397f14, pfContextAttr=0x2394880, ptsExpiry=0x19ec58 | out: phNewContext=0x2395fa8, pOutput=0x2397f14, pfContextAttr=0x2394880, ptsExpiry=0x19ec58) returned 0x90312 [0252.815] recv (in: s=0x634, buf=0x2397fa4, len=5, flags=0 | out: buf=0x2397fa4*) returned 5 [0252.816] recv (in: s=0x634, buf=0x2397fbd, len=1, flags=0 | out: buf=0x2397fbd*) returned 1 [0252.816] InitializeSecurityContextW (in: phCredential=0x19ebc8, phContext=0x19ec54, pTargetName=0x2392a1c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2398030, Reserved2=0x0, phNewContext=0x2395fa8, pOutput=0x2398044, pfContextAttr=0x2394880, ptsExpiry=0x19ebc0 | out: phNewContext=0x2395fa8, pOutput=0x2398044, pfContextAttr=0x2394880, ptsExpiry=0x19ebc0) returned 0x90312 [0252.816] recv (in: s=0x634, buf=0x23980d4, len=5, flags=0 | out: buf=0x23980d4*) returned 5 [0252.816] recv (in: s=0x634, buf=0x23980ed, len=40, flags=0 | out: buf=0x23980ed*) returned 40 [0252.817] InitializeSecurityContextW (in: phCredential=0x19eb30, phContext=0x19ebbc, pTargetName=0x2392a1c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2398188, Reserved2=0x0, phNewContext=0x2395fa8, pOutput=0x239819c, pfContextAttr=0x2394880, ptsExpiry=0x19eb28 | out: phNewContext=0x2395fa8, pOutput=0x239819c, pfContextAttr=0x2394880, ptsExpiry=0x19eb28) returned 0x0 [0253.468] QueryContextAttributesW (in: phContext=0x2395fa8, ulAttribute=0x4, pBuffer=0x2398248 | out: pBuffer=0x2398248) returned 0x0 [0253.468] QueryContextAttributesW (in: phContext=0x2395fa8, ulAttribute=0x5a, pBuffer=0x23982a0 | out: pBuffer=0x23982a0) returned 0x0 [0253.471] QueryContextAttributesW (in: phContext=0x2395fa8, ulAttribute=0x53, pBuffer=0x2398554 | out: pBuffer=0x2398554) returned 0x0 [0253.483] CertDuplicateCertificateContext (pCertContext=0x8a9ed0) returned 0x8a9ed0 [0253.484] CertDuplicateStore (hCertStore=0x8342a0) returned 0x8342a0 [0253.484] CertEnumCertificatesInStore (hCertStore=0x8342a0, pPrevCertContext=0x0) returned 0x8a9c50 [0253.484] CertDuplicateCertificateContext (pCertContext=0x8a9c50) returned 0x8a9c50 [0253.485] CertEnumCertificatesInStore (hCertStore=0x8342a0, pPrevCertContext=0x8a9c50) returned 0x8a9c00 [0253.485] CertDuplicateCertificateContext (pCertContext=0x8a9c00) returned 0x8a9c00 [0253.485] CertEnumCertificatesInStore (hCertStore=0x8342a0, pPrevCertContext=0x8a9c00) returned 0x8a9e30 [0253.485] CertDuplicateCertificateContext (pCertContext=0x8a9e30) returned 0x8a9e30 [0253.485] CertEnumCertificatesInStore (hCertStore=0x8342a0, pPrevCertContext=0x8a9e30) returned 0x8a9ed0 [0253.485] CertDuplicateCertificateContext (pCertContext=0x8a9ed0) returned 0x8a9ed0 [0253.485] CertEnumCertificatesInStore (hCertStore=0x8342a0, pPrevCertContext=0x8a9ed0) returned 0x0 [0253.485] CertCloseStore (hCertStore=0x8342a0, dwFlags=0x0) returned 1 [0253.485] CertFreeCertificateContext (pCertContext=0x8a9ed0) returned 1 [0253.499] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x834390 [0253.502] CertAddCRLLinkToStore (in: hCertStore=0x834390, pCrlContext=0x8a9c50, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0253.508] CertAddCRLLinkToStore (in: hCertStore=0x834390, pCrlContext=0x8a9c00, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0253.508] CertAddCRLLinkToStore (in: hCertStore=0x834390, pCrlContext=0x8a9e30, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0253.508] CertAddCRLLinkToStore (in: hCertStore=0x834390, pCrlContext=0x8a9ed0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0253.518] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x8a9ed0, pTime=0x19eb3c, hAdditionalStore=0x834390, pChainPara=0x19ea7c, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x19ea70 | out: ppChainContext=0x19ea70) returned 1 [0253.540] CertDuplicateCertificateChain (pChainContext=0x51ef0b8) returned 0x51ef0b8 [0253.541] CertDuplicateCertificateContext (pCertContext=0x8a9ed0) returned 0x8a9ed0 [0253.541] CertDuplicateCertificateContext (pCertContext=0x8a9cf0) returned 0x8a9cf0 [0253.541] CertDuplicateCertificateContext (pCertContext=0x8a9d90) returned 0x8a9d90 [0253.541] CertDuplicateCertificateContext (pCertContext=0x8a9ac0) returned 0x8a9ac0 [0253.541] CertFreeCertificateChain (pChainContext=0x51ef0b8) [0253.542] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x51ef0b8, pPolicyPara=0x19ec1c, pPolicyStatus=0x19ec08 | out: pPolicyStatus=0x19ec08) returned 1 [0253.543] SetLastError (dwErrCode=0x0) [0253.545] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x51ef0b8, pPolicyPara=0x19ec88, pPolicyStatus=0x19ec30 | out: pPolicyStatus=0x19ec30) returned 1 [0253.551] CertFreeCertificateChain (pChainContext=0x51ef0b8) [0253.551] CertFreeCertificateContext (pCertContext=0x8a9ed0) returned 1 [0253.554] CoTaskMemAlloc (cb=0x20c) returned 0x51ef0b8 [0253.554] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x51ef0b8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0253.554] CoTaskMemFree (pv=0x51ef0b8) [0253.554] CoTaskMemAlloc (cb=0x20c) returned 0x51ef0b8 [0253.554] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x51ef0b8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0253.554] CoTaskMemFree (pv=0x51ef0b8) [0253.554] CoTaskMemAlloc (cb=0x20c) returned 0x51ef0b8 [0253.554] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x51ef0b8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0253.554] CoTaskMemFree (pv=0x51ef0b8) [0253.555] CoTaskMemAlloc (cb=0x20c) returned 0x51ef0b8 [0253.555] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x51ef0b8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0253.555] CoTaskMemFree (pv=0x51ef0b8) [0253.558] EncryptMessage (in: phContext=0x2395fa8, fQOP=0x0, pMessage=0x23a0c00, MessageSeqNo=0x0 | out: pMessage=0x23a0c00) returned 0x0 [0253.558] send (s=0x634, buf=0x239f6d8*, len=289, flags=0) returned 289 [0253.560] select (in: nfds=0, readfds=0x23a0ca4, writefds=0x0, exceptfds=0x0, timeout=0x19f23c*(tv_sec=0, tv_usec=350000) | out: readfds=0x23a0ca4, writefds=0x0, exceptfds=0x0) returned 1 [0253.580] setsockopt (s=0x634, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0253.581] recv (in: s=0x634, buf=0x23acf08, len=5, flags=0 | out: buf=0x23acf08*) returned 5 [0253.581] recv (in: s=0x634, buf=0x23acf0d, len=49, flags=0 | out: buf=0x23acf0d*) returned 49 [0253.582] DecryptMessage (in: phContext=0x2395fa8, pMessage=0x23b0fc8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23b0fc8, pfQOP=0x0) returned 0x0 [0253.597] EncryptMessage (in: phContext=0x2395fa8, fQOP=0x0, pMessage=0x23b179c, MessageSeqNo=0x0 | out: pMessage=0x23b179c) returned 0x0 [0253.598] CoTaskMemAlloc (cb=0x8) returned 0x51e9b88 [0253.598] WSASend (in: s=0x634, lpBuffers=0x51e9b88*=((len=0x393, buf=0x23b1374*)), dwBufferCount=0x1, lpNumberOfBytesSent=0x19f0c0, dwFlags=0x0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpNumberOfBytesSent=0x19f0c0*=0x393, lpOverlapped=0x0) returned 0 [0253.599] CoTaskMemFree (pv=0x51e9b88) [0253.599] recv (in: s=0x634, buf=0x23acf08, len=5, flags=0 | out: buf=0x23acf08*) returned 5 [0253.920] recv (in: s=0x634, buf=0x23acf0d, len=1035, flags=0 | out: buf=0x23acf0d*) returned 1035 [0253.921] DecryptMessage (in: phContext=0x2395fa8, pMessage=0x23b18fc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23b18fc, pfQOP=0x0) returned 0x0 [0253.930] setsockopt (s=0x634, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0253.931] SetEvent (hEvent=0x230) returned 1 [0254.009] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f3f8 | out: UnbiasedTime=0x19f3f8) returned 1 [0254.009] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x19f3e8 | out: UnbiasedTime=0x19f3e8) returned 1 [0254.038] GetModuleHandleW (lpModuleName="user32.dll") returned 0x75640000 [0254.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x19dbfc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWXiÀ<ÓÍ «\"kèÞ\x19", lpUsedDefaultChar=0x0) returned 14 [0254.039] GetProcAddress (hModule=0x75640000, lpProcName="DefWindowProcW") returned 0x778baee0 [0254.040] GetStockObject (i=5) returned 0x1900015 [0254.044] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0254.047] CoTaskMemAlloc (cb=0x5c) returned 0x51e63d0 [0254.047] RegisterClassW (lpWndClass=0x19dbec) returned 0xc150 [0254.049] CoTaskMemFree (pv=0x51e63d0) [0254.050] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0254.051] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.0.app.0.232467a_r10_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x90124 [0254.068] SetWindowLongW (hWnd=0x90124, nIndex=-4, dwNewLong=2005642976) returned 74647078 [0254.070] GetWindowLongW (hWnd=0x90124, nIndex=-4) returned 2005642976 [0254.071] GetCurrentProcess () returned 0xffffffff [0254.072] GetCurrentThread () returned 0xfffffffe [0254.072] GetCurrentProcess () returned 0xffffffff [0254.072] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19d4c8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19d4c8*=0x734) returned 1 [0254.077] GetCurrentThreadId () returned 0x2fc [0254.079] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19d44c | out: phkResult=0x19d44c*=0x738) returned 0x0 [0254.079] RegQueryValueExW (in: hKey=0x738, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19d46c, lpData=0x0, lpcbData=0x19d468*=0x0 | out: lpType=0x19d46c*=0x0, lpData=0x0, lpcbData=0x19d468*=0x0) returned 0x2 [0254.079] RegQueryValueExW (in: hKey=0x738, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19d46c, lpData=0x0, lpcbData=0x19d468*=0x0 | out: lpType=0x19d46c*=0x0, lpData=0x0, lpcbData=0x19d468*=0x0) returned 0x2 [0254.079] RegCloseKey (hKey=0x738) returned 0x0 [0254.081] SetWindowLongW (hWnd=0x90124, nIndex=-4, dwNewLong=74647118) returned 2005642976 [0254.081] GetWindowLongW (hWnd=0x90124, nIndex=-4) returned 74647118 [0254.081] GetWindowLongW (hWnd=0x90124, nIndex=-16) returned 79691776 [0254.149] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x24, wParam=0x0, lParam=0x19d764) returned 0x0 [0254.150] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc1e7 [0254.153] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x81, wParam=0x0, lParam=0x19d758) returned 0x1 [0254.258] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x83, wParam=0x0, lParam=0x19d744) returned 0x0 [0254.304] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x1, wParam=0x0, lParam=0x19d758) returned 0x0 [0254.353] SetClipboardViewer (hWndNewViewer=0x90124) returned 0x0 [0254.411] OleInitialize (pvReserved=0x0) returned 0x0 [0254.416] OleGetClipboard (in: ppDataObj=0x19f1b4 | out: ppDataObj=0x19f1b4*=0x51ee510) returned 0x0 [0254.421] IUnknown:QueryInterface (in: This=0x51ee510, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec74 | out: ppvObject=0x19ec74*=0x51ee510) returned 0x0 [0254.423] IUnknown:QueryInterface (in: This=0x51ee510, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec30 | out: ppvObject=0x19ec30*=0x0) returned 0x80004002 [0254.423] IUnknown:QueryInterface (in: This=0x51ee510, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ea4c | out: ppvObject=0x19ea4c*=0x0) returned 0x80004002 [0254.424] IUnknown:QueryInterface (in: This=0x51ee510, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e824 | out: ppvObject=0x19e824*=0x0) returned 0x80004002 [0254.424] IUnknown:AddRef (This=0x51ee510) returned 0x3 [0254.424] IUnknown:QueryInterface (in: This=0x51ee510, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e58c | out: ppvObject=0x19e58c*=0x0) returned 0x80004002 [0254.424] IUnknown:QueryInterface (in: This=0x51ee510, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e53c | out: ppvObject=0x19e53c*=0x0) returned 0x80004002 [0254.424] IUnknown:QueryInterface (in: This=0x51ee510, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e548 | out: ppvObject=0x19e548*=0x0) returned 0x80004002 [0254.424] CoGetContextToken (in: pToken=0x19e5a8 | out: pToken=0x19e5a8) returned 0x0 [0254.425] CoGetContextToken (in: pToken=0x19e9b0 | out: pToken=0x19e9b0) returned 0x0 [0254.425] IUnknown:QueryInterface (in: This=0x51ee510, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea40 | out: ppvObject=0x19ea40*=0x0) returned 0x80004002 [0254.425] IUnknown:Release (This=0x51ee510) returned 0x2 [0254.425] CoGetContextToken (in: pToken=0x19ef88 | out: pToken=0x19ef88) returned 0x0 [0254.425] CoGetContextToken (in: pToken=0x19eee8 | out: pToken=0x19eee8) returned 0x0 [0254.425] IUnknown:QueryInterface (in: This=0x51ee510, riid=0x19efb8*(Data1=0x10e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efb4 | out: ppvObject=0x19efb4*=0x51ee510) returned 0x0 [0254.425] IUnknown:AddRef (This=0x51ee510) returned 0x4 [0254.425] IUnknown:Release (This=0x51ee510) returned 0x3 [0254.425] IUnknown:Release (This=0x51ee510) returned 0x2 [0254.427] CoGetContextToken (in: pToken=0x19f000 | out: pToken=0x19f000) returned 0x0 [0254.428] CoGetContextToken (in: pToken=0x19ef60 | out: pToken=0x19ef60) returned 0x0 [0254.428] IUnknown:QueryInterface (in: This=0x51ee510, riid=0x19f030*(Data1=0x3cee8cc1, Data2=0x1adb, Data3=0x327f, Data4=([0]=0x9b, [1]=0x97, [2]=0x7a, [3]=0x9c, [4]=0x80, [5]=0x89, [6]=0xbf, [7]=0xb3)), ppvObject=0x19f02c | out: ppvObject=0x19f02c*=0x0) returned 0x80004002 [0254.454] IDataObject:QueryGetData (This=0x51ee510, pformatetc=0x19f174) returned 0x0 [0254.464] IDataObject:RemoteGetData (in: This=0x51ee510, pformatetcIn=0x19f174, pRemoteMedium=0x19f104 | out: pRemoteMedium=0x19f104) returned 0x0 [0254.468] GlobalLock (hMem=0x57a0004) returned 0x51f1f90 [0254.468] GlobalUnlock (hMem=0x57a0004) returned 0 [0254.501] SendMessageW (hWnd=0x0, Msg=0x308, wParam=0x0, lParam=0x0) returned 0x0 [0254.501] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x308, wParam=0x0, lParam=0x0) returned 0x0 [0254.561] GetCurrentProcessId () returned 0x12b0 [0254.564] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12b0) returned 0x74c [0254.653] EnumProcessModules (in: hProcess=0x74c, lphModule=0x23b58c0, cb=0x100, lpcbNeeded=0x19f438 | out: lphModule=0x23b58c0, lpcbNeeded=0x19f438) returned 1 [0254.656] EnumProcessModules (in: hProcess=0x74c, lphModule=0x23b59cc, cb=0x200, lpcbNeeded=0x19f438 | out: lphModule=0x23b59cc, lpcbNeeded=0x19f438) returned 1 [0254.659] GetModuleInformation (in: hProcess=0x74c, hModule=0x400000, lpmodinfo=0x23b5c0c, cb=0xc | out: lpmodinfo=0x23b5c0c*(lpBaseOfDll=0x400000, SizeOfImage=0x66000, EntryPoint=0x0)) returned 1 [0254.660] CoTaskMemAlloc (cb=0x804) returned 0x8b6818 [0254.660] GetModuleBaseNameW (in: hProcess=0x74c, hModule=0x400000, lpBaseName=0x8b6818, nSize=0x800 | out: lpBaseName="MSBuild.exe") returned 0xb [0254.661] CoTaskMemFree (pv=0x8b6818) [0254.661] CoTaskMemAlloc (cb=0x804) returned 0x8b6818 [0254.661] GetModuleFileNameExW (in: hProcess=0x74c, hModule=0x400000, lpFilename=0x8b6818, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe")) returned 0x39 [0254.662] CoTaskMemFree (pv=0x8b6818) [0254.662] CloseHandle (hObject=0x74c) returned 1 [0254.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MSBuild.exe", cchWideChar=11, lpMultiByteStr=0x19f42c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MSBuild.exekk\x19Ï\x04À<ÓÍ «\"khö\x19", lpUsedDefaultChar=0x0) returned 11 [0254.687] GetModuleHandleA (lpModuleName="MSBuild.exe") returned 0x400000 [0254.703] SetWindowsHookExW (idHook=13, lpfn=0x4730676, hmod=0x400000, dwThreadId=0x0) returned 0x1500df [0254.711] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc20b [0254.711] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc20a [0254.713] GetSystemMetrics (nIndex=75) returned 1 [0254.727] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0254.736] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x682b0000 [0254.765] GetStockObject (i=5) returned 0x1900015 [0254.766] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0254.766] CoTaskMemAlloc (cb=0x5c) returned 0x51e6570 [0254.766] RegisterClassW (lpWndClass=0x19f224) returned 0xc207 [0254.768] CoTaskMemFree (pv=0x51e6570) [0254.768] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0254.768] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.232467a_r10_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x902ae [0254.770] SetWindowLongW (hWnd=0x902ae, nIndex=-4, dwNewLong=2005642976) returned 74647198 [0254.771] GetWindowLongW (hWnd=0x902ae, nIndex=-4) returned 2005642976 [0254.771] SetWindowLongW (hWnd=0x902ae, nIndex=-4, dwNewLong=74647238) returned 2005642976 [0254.771] GetWindowLongW (hWnd=0x902ae, nIndex=-4) returned 74647238 [0254.771] GetWindowLongW (hWnd=0x902ae, nIndex=-16) returned 113311744 [0254.772] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc1e6 [0254.772] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x902ae, Msg=0x24, wParam=0x0, lParam=0x19ed9c) returned 0x0 [0254.772] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x902ae, Msg=0x81, wParam=0x0, lParam=0x19ed90) returned 0x1 [0254.773] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x902ae, Msg=0x83, wParam=0x0, lParam=0x19ed7c) returned 0x0 [0254.773] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x902ae, Msg=0x1, wParam=0x0, lParam=0x19ed90) returned 0x0 [0254.774] GetClientRect (in: hWnd=0x902ae, lpRect=0x19eabc | out: lpRect=0x19eabc) returned 1 [0254.774] GetWindowRect (in: hWnd=0x902ae, lpRect=0x19eabc | out: lpRect=0x19eabc) returned 1 [0254.775] GetParent (hWnd=0x902ae) returned 0x0 [0254.776] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x19f444 | out: lplpMessageFilter=0x19f444*=0x0) returned 0x0 [0254.778] PeekMessageW (in: lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f418) returned 1 [0254.779] IsWindowUnicode (hWnd=0x90124) returned 1 [0254.779] GetMessageW (in: lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19f418) returned 1 [0254.782] TranslateMessage (lpMsg=0x19f418) returned 0 [0254.782] DispatchMessageW (lpMsg=0x19f418) returned 0x0 [0254.784] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0254.784] PeekMessageW (in: lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f418) returned 0 [0254.784] PeekMessageW (in: lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f418) returned 0 [0254.785] WaitMessage () returned 1 [0256.706] PeekMessageW (in: lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f418) returned 0 [0258.743] GetForegroundWindow () returned 0x301fe [0258.751] GetWindowThreadProcessId (in: hWnd=0x301fe, lpdwProcessId=0x594730 | out: lpdwProcessId=0x594730) returned 0x58c [0258.777] GetWindowTextLengthW (hWnd=0x301fe) returned 30 [0258.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x23b95dc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 0 [0258.868] GetWindowTextA (in: hWnd=0x301fe, lpString=0x19f000, nMaxCount=31 | out: lpString="Blank Page - Internet Explorer") returned 30 [0259.084] CallNextHookEx (hhk=0x0, nCode=0, wParam=0x100, lParam=0x19f304) returned 0x0 [0259.085] PeekMessageW (in: lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f418) returned 0 [0259.085] WaitMessage () returned 1 [0259.660] PeekMessageW (lpMsg=0x19f418, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0) [0259.660] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x3b, wParam=0x50e, lParam=0x0) returned 0x1 [0259.661] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x11, wParam=0x0, lParam=0x0) returned 0x1 [0259.662] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x1c, wParam=0x1, lParam=0x10ac) returned 0x0 [0259.662] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0259.668] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0259.685] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0259.692] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0259.693] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0259.693] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0259.696] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x46, wParam=0x0, lParam=0x19f2ec) returned 0x0 [0259.696] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x47, wParam=0x0, lParam=0x19f2ec) returned 0x0 [0259.698] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x3b, wParam=0x50c, lParam=0x0) returned 0x2 [0259.699] CallWindowProcW (lpPrevWndFunc=0x778baee0, hWnd=0x90124, Msg=0x16, wParam=0x1, lParam=0x0) returned 0x0 Thread: id = 13 os_tid = 0xf54 Thread: id = 16 os_tid = 0x980 Thread: id = 17 os_tid = 0x1368 [0196.890] CoGetContextToken (in: pToken=0x436fc3c | out: pToken=0x436fc3c) returned 0x800401f0 [0196.890] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0196.890] RoInitialize () returned 0x1 [0196.890] RoUninitialize () returned 0x0 [0239.801] CoGetContextToken (in: pToken=0x436fc30 | out: pToken=0x436fc30) returned 0x0 [0239.801] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0239.801] WbemDefPath:IUnknown:Release (This=0x82c278) returned 0x1 [0239.801] WbemDefPath:IUnknown:Release (This=0x82c278) returned 0x0 [0239.801] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0239.801] WbemDefPath:IUnknown:Release (This=0x862c38) returned 0x1 [0239.801] WbemDefPath:IUnknown:Release (This=0x862c38) returned 0x0 [0239.801] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0239.801] WbemDefPath:IUnknown:Release (This=0x862e68) returned 0x1 [0239.801] WbemDefPath:IUnknown:Release (This=0x862e68) returned 0x0 [0239.801] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0239.801] WbemDefPath:IUnknown:Release (This=0x862df8) returned 0x1 [0239.801] WbemDefPath:IUnknown:Release (This=0x862df8) returned 0x0 [0239.801] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0239.802] WbemDefPath:IUnknown:Release (This=0x862d18) returned 0x1 [0239.802] WbemDefPath:IUnknown:Release (This=0x862d18) returned 0x0 [0239.802] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0239.802] WbemDefPath:IUnknown:Release (This=0x8633a8) returned 0x1 [0239.802] WbemDefPath:IUnknown:Release (This=0x8633a8) returned 0x0 [0239.802] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0239.802] WbemDefPath:IUnknown:Release (This=0x863108) returned 0x1 [0239.802] WbemDefPath:IUnknown:Release (This=0x863108) returned 0x0 [0239.802] CoGetContextToken (in: pToken=0x436fc30 | out: pToken=0x436fc30) returned 0x0 [0239.802] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0239.802] WbemLocator:IUnknown:Release (This=0x887d78) returned 0x1 [0239.802] WbemLocator:IUnknown:Release (This=0x887d78) returned 0x0 [0239.802] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0239.802] WbemLocator:IUnknown:Release (This=0x887e28) returned 0x1 [0239.802] WbemLocator:IUnknown:Release (This=0x887e28) returned 0x0 [0239.802] CoGetContextToken (in: pToken=0x436fc30 | out: pToken=0x436fc30) returned 0x0 [0239.802] IUnknown:QueryInterface (in: This=0x810080, riid=0x6b2e8724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x436fbd8 | out: ppvObject=0x436fbd8*=0x810090) returned 0x0 [0239.803] CObjectContext::ContextCallback () returned 0x0 [0243.986] IUnknown:Release (This=0x810090) returned 0x1 [0243.990] IUnknown:Release (This=0x89b7e8) returned 0x0 [0243.990] CoGetContextToken (in: pToken=0x436fa50 | out: pToken=0x436fa50) returned 0x0 [0243.990] IUnknown:QueryInterface (in: This=0x810080, riid=0x6b2e8724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x436f9f8 | out: ppvObject=0x436f9f8*=0x810090) returned 0x0 [0243.991] CObjectContext::ContextCallback () returned 0x0 [0244.094] IUnknown:Release (This=0x810090) returned 0x1 [0244.094] IUnknown:Release (This=0x88c5c0) returned 0x0 [0244.095] IUnknown:Release (This=0x89b320) returned 0x0 [0244.095] CoGetContextToken (in: pToken=0x436fa50 | out: pToken=0x436fa50) returned 0x0 [0244.095] IUnknown:QueryInterface (in: This=0x810080, riid=0x6b2e8724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x436f9f8 | out: ppvObject=0x436f9f8*=0x810090) returned 0x0 [0244.096] CObjectContext::ContextCallback () returned 0x0 [0244.113] IUnknown:Release (This=0x810090) returned 0x1 [0244.114] IUnknown:Release (This=0x810080) returned 0x0 [0244.114] IUnknown:Release (This=0x89aa98) returned 0x0 [0244.117] CloseHandle (hObject=0x244) returned 1 [0244.117] CloseHandle (hObject=0x460) returned 1 [0244.118] CloseHandle (hObject=0x42c) returned 1 [0244.118] RegCloseKey (hKey=0x488) returned 0x0 [0244.118] CloseHandle (hObject=0x3dc) returned 1 [0244.118] CloseHandle (hObject=0x3d8) returned 1 [0244.118] CloseHandle (hObject=0x3a0) returned 1 [0244.119] CloseHandle (hObject=0x458) returned 1 [0244.120] CloseHandle (hObject=0x454) returned 1 [0244.120] CloseHandle (hObject=0x46c) returned 1 [0244.120] CloseHandle (hObject=0x260) returned 1 [0244.120] CloseHandle (hObject=0x468) returned 1 [0244.121] CloseHandle (hObject=0x25c) returned 1 [0244.121] CloseHandle (hObject=0x450) returned 1 [0244.121] CloseHandle (hObject=0x258) returned 1 [0244.121] CloseHandle (hObject=0x254) returned 1 [0244.121] CloseHandle (hObject=0x438) returned 1 [0244.122] CloseHandle (hObject=0x434) returned 1 [0244.122] CloseHandle (hObject=0x250) returned 1 [0244.122] CloseHandle (hObject=0x24c) returned 1 [0244.122] CloseHandle (hObject=0x430) returned 1 [0244.122] CloseHandle (hObject=0x248) returned 1 [0244.122] CloseHandle (hObject=0x464) returned 1 Thread: id = 18 os_tid = 0x1370 Thread: id = 19 os_tid = 0x88c Thread: id = 20 os_tid = 0x934 Thread: id = 125 os_tid = 0x11f4 [0212.698] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0212.698] RoInitialize () returned 0x1 [0212.698] RoUninitialize () returned 0x0 [0212.733] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x4e3f5b4 | out: lpiid=0x4e3f5b4) returned 0x0 [0212.750] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887e58) returned 0x0 [0212.750] WbemDefPath:IUnknown:QueryInterface (in: This=0x887e58, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0212.750] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887e58, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x82c278) returned 0x0 [0212.751] WbemDefPath:IUnknown:Release (This=0x887e58) returned 0x0 [0212.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x82c278, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x82c278) returned 0x0 [0212.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x82c278, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0212.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x82c278, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0212.751] WbemDefPath:IUnknown:AddRef (This=0x82c278) returned 0x3 [0212.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x82c278, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0212.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x82c278, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0212.751] WbemDefPath:IUnknown:QueryInterface (in: This=0x82c278, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x884e70) returned 0x0 [0212.751] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x884e70, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0212.751] WbemDefPath:IUnknown:Release (This=0x884e70) returned 0x3 [0212.751] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0212.753] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0212.753] WbemDefPath:IUnknown:QueryInterface (in: This=0x82c278, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0212.753] WbemDefPath:IUnknown:Release (This=0x82c278) returned 0x2 [0212.753] WbemDefPath:IUnknown:Release (This=0x82c278) returned 0x1 [0212.754] SetEvent (hEvent=0x3a0) returned 1 [0212.765] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887d68) returned 0x0 [0212.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x887d68, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0212.766] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887d68, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x8069c8) returned 0x0 [0212.766] WbemDefPath:IUnknown:Release (This=0x887d68) returned 0x0 [0212.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x8069c8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x8069c8) returned 0x0 [0212.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x8069c8, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0212.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x8069c8, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0212.766] WbemDefPath:IUnknown:AddRef (This=0x8069c8) returned 0x3 [0212.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x8069c8, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0212.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x8069c8, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0212.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x8069c8, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x884e58) returned 0x0 [0212.766] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x884e58, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0212.766] WbemDefPath:IUnknown:Release (This=0x884e58) returned 0x3 [0212.766] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0212.767] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0212.767] WbemDefPath:IUnknown:QueryInterface (in: This=0x8069c8, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0212.767] WbemDefPath:IUnknown:Release (This=0x8069c8) returned 0x2 [0212.767] WbemDefPath:IUnknown:Release (This=0x8069c8) returned 0x1 [0212.767] SetEvent (hEvent=0x3d8) returned 1 [0212.769] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887eb8) returned 0x0 [0212.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x887eb8, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0212.770] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887eb8, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x8828f0) returned 0x0 [0212.770] WbemDefPath:IUnknown:Release (This=0x887eb8) returned 0x0 [0212.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x8828f0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x8828f0) returned 0x0 [0212.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x8828f0, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0212.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x8828f0, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0212.770] WbemDefPath:IUnknown:AddRef (This=0x8828f0) returned 0x3 [0212.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x8828f0, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0212.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x8828f0, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0212.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x8828f0, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x885128) returned 0x0 [0212.770] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x885128, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0212.770] WbemDefPath:IUnknown:Release (This=0x885128) returned 0x3 [0212.770] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0212.770] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0212.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x8828f0, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0212.771] WbemDefPath:IUnknown:Release (This=0x8828f0) returned 0x2 [0212.771] WbemDefPath:IUnknown:Release (This=0x8828f0) returned 0x1 [0212.771] SetEvent (hEvent=0x3dc) returned 1 [0215.900] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887db8) returned 0x0 [0215.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x887db8, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0215.900] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887db8, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x8877d8) returned 0x0 [0215.900] WbemDefPath:IUnknown:Release (This=0x887db8) returned 0x0 [0215.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x8877d8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x8877d8) returned 0x0 [0215.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x8877d8, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0215.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x8877d8, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0215.900] WbemDefPath:IUnknown:AddRef (This=0x8877d8) returned 0x3 [0215.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x8877d8, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0215.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x8877d8, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0215.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x8877d8, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x885338) returned 0x0 [0215.901] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x885338, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0215.901] WbemDefPath:IUnknown:Release (This=0x885338) returned 0x3 [0215.901] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0215.901] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0215.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x8877d8, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0215.901] WbemDefPath:IUnknown:Release (This=0x8877d8) returned 0x2 [0215.901] WbemDefPath:IUnknown:Release (This=0x8877d8) returned 0x1 [0215.901] SetEvent (hEvent=0x42c) returned 1 [0234.248] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887e98) returned 0x0 [0234.249] WbemDefPath:IUnknown:QueryInterface (in: This=0x887e98, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0234.249] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887e98, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x86bb90) returned 0x0 [0234.250] WbemDefPath:IUnknown:Release (This=0x887e98) returned 0x0 [0234.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x86bb90, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x86bb90) returned 0x0 [0234.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x86bb90, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0234.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x86bb90, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0234.250] WbemDefPath:IUnknown:AddRef (This=0x86bb90) returned 0x3 [0234.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x86bb90, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0234.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x86bb90, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0234.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x86bb90, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x897bf0) returned 0x0 [0234.250] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x897bf0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.250] WbemDefPath:IUnknown:Release (This=0x897bf0) returned 0x3 [0234.250] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0234.250] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0234.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x86bb90, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0234.250] WbemDefPath:IUnknown:Release (This=0x86bb90) returned 0x2 [0234.250] WbemDefPath:IUnknown:Release (This=0x86bb90) returned 0x1 [0234.251] SetEvent (hEvent=0x430) returned 1 [0234.295] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887e58) returned 0x0 [0234.297] WbemDefPath:IUnknown:QueryInterface (in: This=0x887e58, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0234.297] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887e58, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x862c38) returned 0x0 [0234.297] WbemDefPath:IUnknown:Release (This=0x887e58) returned 0x0 [0234.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x862c38, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x862c38) returned 0x0 [0234.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x862c38, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0234.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x862c38, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0234.298] WbemDefPath:IUnknown:AddRef (This=0x862c38) returned 0x3 [0234.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x862c38, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0234.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x862c38, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0234.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x862c38, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x897d10) returned 0x0 [0234.298] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x897d10, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.298] WbemDefPath:IUnknown:Release (This=0x897d10) returned 0x3 [0234.298] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0234.298] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0234.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x862c38, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0234.298] WbemDefPath:IUnknown:Release (This=0x862c38) returned 0x2 [0234.298] WbemDefPath:IUnknown:Release (This=0x862c38) returned 0x1 [0234.298] SetEvent (hEvent=0x434) returned 1 [0234.301] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887e18) returned 0x0 [0234.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x887e18, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0234.301] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887e18, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x863098) returned 0x0 [0234.301] WbemDefPath:IUnknown:Release (This=0x887e18) returned 0x0 [0234.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x863098, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x863098) returned 0x0 [0234.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x863098, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0234.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x863098, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0234.301] WbemDefPath:IUnknown:AddRef (This=0x863098) returned 0x3 [0234.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x863098, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0234.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x863098, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0234.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x863098, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x897c20) returned 0x0 [0234.301] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x897c20, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.302] WbemDefPath:IUnknown:Release (This=0x897c20) returned 0x3 [0234.302] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0234.302] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0234.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x863098, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0234.302] WbemDefPath:IUnknown:Release (This=0x863098) returned 0x2 [0234.302] WbemDefPath:IUnknown:Release (This=0x863098) returned 0x1 [0234.302] SetEvent (hEvent=0x438) returned 1 [0234.414] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887dc8) returned 0x0 [0234.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x887dc8, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0234.415] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887dc8, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x862ca8) returned 0x0 [0234.415] WbemDefPath:IUnknown:Release (This=0x887dc8) returned 0x0 [0234.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x862ca8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x862ca8) returned 0x0 [0234.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x862ca8, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0234.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x862ca8, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0234.415] WbemDefPath:IUnknown:AddRef (This=0x862ca8) returned 0x3 [0234.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x862ca8, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0234.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x862ca8, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0234.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x862ca8, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x897ef0) returned 0x0 [0234.415] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x897ef0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.415] WbemDefPath:IUnknown:Release (This=0x897ef0) returned 0x3 [0234.415] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0234.415] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0234.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x862ca8, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0234.416] WbemDefPath:IUnknown:Release (This=0x862ca8) returned 0x2 [0234.416] WbemDefPath:IUnknown:Release (This=0x862ca8) returned 0x1 [0234.416] SetEvent (hEvent=0x450) returned 1 [0234.784] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887b98) returned 0x0 [0234.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x887b98, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0234.784] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887b98, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x862e68) returned 0x0 [0234.784] WbemDefPath:IUnknown:Release (This=0x887b98) returned 0x0 [0234.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x862e68, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x862e68) returned 0x0 [0234.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x862e68, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0234.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x862e68, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0234.785] WbemDefPath:IUnknown:AddRef (This=0x862e68) returned 0x3 [0234.785] WbemDefPath:IUnknown:QueryInterface (in: This=0x862e68, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0234.785] WbemDefPath:IUnknown:QueryInterface (in: This=0x862e68, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0234.785] WbemDefPath:IUnknown:QueryInterface (in: This=0x862e68, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x898160) returned 0x0 [0234.785] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x898160, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.785] WbemDefPath:IUnknown:Release (This=0x898160) returned 0x3 [0234.785] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0234.785] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0234.785] WbemDefPath:IUnknown:QueryInterface (in: This=0x862e68, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0234.785] WbemDefPath:IUnknown:Release (This=0x862e68) returned 0x2 [0234.785] WbemDefPath:IUnknown:Release (This=0x862e68) returned 0x1 [0234.785] SetEvent (hEvent=0x454) returned 1 [0234.847] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887c78) returned 0x0 [0234.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x887c78, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0234.848] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887c78, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x862df8) returned 0x0 [0234.848] WbemDefPath:IUnknown:Release (This=0x887c78) returned 0x0 [0234.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x862df8) returned 0x0 [0234.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0234.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0234.848] WbemDefPath:IUnknown:AddRef (This=0x862df8) returned 0x3 [0234.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0234.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0234.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x8bfdf0) returned 0x0 [0234.849] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8bfdf0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.849] WbemDefPath:IUnknown:Release (This=0x8bfdf0) returned 0x3 [0234.849] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0234.849] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0234.849] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0234.849] WbemDefPath:IUnknown:Release (This=0x862df8) returned 0x2 [0234.849] WbemDefPath:IUnknown:Release (This=0x862df8) returned 0x1 [0234.849] SetEvent (hEvent=0x458) returned 1 [0234.856] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887c18) returned 0x0 [0234.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x887c18, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0234.856] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887c18, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x862d18) returned 0x0 [0234.856] WbemDefPath:IUnknown:Release (This=0x887c18) returned 0x0 [0234.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x862d18, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x862d18) returned 0x0 [0234.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x862d18, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0234.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x862d18, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0234.857] WbemDefPath:IUnknown:AddRef (This=0x862d18) returned 0x3 [0234.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x862d18, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0234.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x862d18, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0234.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x862d18, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x8bfef8) returned 0x0 [0234.857] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8bfef8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.857] WbemDefPath:IUnknown:Release (This=0x8bfef8) returned 0x3 [0234.857] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0234.857] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0234.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x862d18, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0234.857] WbemDefPath:IUnknown:Release (This=0x862d18) returned 0x2 [0234.857] WbemDefPath:IUnknown:Release (This=0x862d18) returned 0x1 [0234.857] SetEvent (hEvent=0x460) returned 1 [0234.864] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887c68) returned 0x0 [0234.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x887c68, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0234.864] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887c68, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x8633a8) returned 0x0 [0234.864] WbemDefPath:IUnknown:Release (This=0x887c68) returned 0x0 [0234.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x8633a8) returned 0x0 [0234.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0234.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0234.865] WbemDefPath:IUnknown:AddRef (This=0x8633a8) returned 0x3 [0234.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0234.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0234.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x8c03c0) returned 0x0 [0234.865] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8c03c0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.865] WbemDefPath:IUnknown:Release (This=0x8c03c0) returned 0x3 [0234.865] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0234.865] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0234.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0234.865] WbemDefPath:IUnknown:Release (This=0x8633a8) returned 0x2 [0234.865] WbemDefPath:IUnknown:Release (This=0x8633a8) returned 0x1 [0234.865] SetEvent (hEvent=0x464) returned 1 [0234.870] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887c08) returned 0x0 [0234.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x887c08, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0234.871] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887c08, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x863108) returned 0x0 [0234.871] WbemDefPath:IUnknown:Release (This=0x887c08) returned 0x0 [0234.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x863108, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x863108) returned 0x0 [0234.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x863108, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0234.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x863108, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0234.871] WbemDefPath:IUnknown:AddRef (This=0x863108) returned 0x3 [0234.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x863108, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0234.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x863108, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0234.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x863108, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x8c0120) returned 0x0 [0234.871] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8c0120, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.871] WbemDefPath:IUnknown:Release (This=0x8c0120) returned 0x3 [0234.871] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0234.871] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0234.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x863108, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0234.872] WbemDefPath:IUnknown:Release (This=0x863108) returned 0x2 [0234.872] WbemDefPath:IUnknown:Release (This=0x863108) returned 0x1 [0234.872] SetEvent (hEvent=0x468) returned 1 [0234.881] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887cb8) returned 0x0 [0234.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x887cb8, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0234.881] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887cb8, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x863258) returned 0x0 [0234.881] WbemDefPath:IUnknown:Release (This=0x887cb8) returned 0x0 [0234.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x863258, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x863258) returned 0x0 [0234.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x863258, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0234.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x863258, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0234.882] WbemDefPath:IUnknown:AddRef (This=0x863258) returned 0x3 [0234.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x863258, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0234.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x863258, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0234.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x863258, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x8c0468) returned 0x0 [0234.882] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8c0468, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.882] WbemDefPath:IUnknown:Release (This=0x8c0468) returned 0x3 [0234.882] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0234.882] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0234.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x863258, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0234.882] WbemDefPath:IUnknown:Release (This=0x863258) returned 0x2 [0234.882] WbemDefPath:IUnknown:Release (This=0x863258) returned 0x1 [0234.882] SetEvent (hEvent=0x46c) returned 1 [0243.961] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887dd8) returned 0x0 [0243.962] WbemDefPath:IUnknown:QueryInterface (in: This=0x887dd8, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0243.962] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887dd8, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x8632c8) returned 0x0 [0243.962] WbemDefPath:IUnknown:Release (This=0x887dd8) returned 0x0 [0243.962] WbemDefPath:IUnknown:QueryInterface (in: This=0x8632c8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x8632c8) returned 0x0 [0243.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x8632c8, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0243.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x8632c8, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0243.963] WbemDefPath:IUnknown:AddRef (This=0x8632c8) returned 0x3 [0243.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x8632c8, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0243.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x8632c8, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0243.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x8632c8, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x8c1428) returned 0x0 [0243.963] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8c1428, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0243.963] WbemDefPath:IUnknown:Release (This=0x8c1428) returned 0x3 [0243.963] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0243.963] CoGetContextToken (in: pToken=0x4e3e9f8 | out: pToken=0x4e3e9f8) returned 0x0 [0243.963] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0243.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x8632c8, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0243.963] WbemDefPath:IUnknown:Release (This=0x8632c8) returned 0x2 [0243.963] WbemDefPath:IUnknown:Release (This=0x8632c8) returned 0x1 [0243.963] SetEvent (hEvent=0x50c) returned 1 [0244.381] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x887bf8) returned 0x0 [0244.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x887bf8, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0244.383] WbemDefPath:IClassFactory:CreateInstance (in: This=0x887bf8, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x8633a8) returned 0x0 [0244.383] WbemDefPath:IUnknown:Release (This=0x887bf8) returned 0x0 [0244.410] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x8633a8) returned 0x0 [0244.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0244.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0244.416] WbemDefPath:IUnknown:AddRef (This=0x8633a8) returned 0x3 [0244.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0244.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0244.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x8c0348) returned 0x0 [0244.416] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8c0348, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0244.416] WbemDefPath:IUnknown:Release (This=0x8c0348) returned 0x3 [0244.416] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0244.416] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0244.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x8633a8, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0244.416] WbemDefPath:IUnknown:Release (This=0x8633a8) returned 0x2 [0244.416] WbemDefPath:IUnknown:Release (This=0x8633a8) returned 0x1 [0244.417] SetEvent (hEvent=0x520) returned 1 [0245.811] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x83c3e0) returned 0x0 [0245.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x83c3e0, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0245.811] WbemDefPath:IClassFactory:CreateInstance (in: This=0x83c3e0, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x862df8) returned 0x0 [0245.811] WbemDefPath:IUnknown:Release (This=0x83c3e0) returned 0x0 [0245.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x862df8) returned 0x0 [0245.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0245.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0245.812] WbemDefPath:IUnknown:AddRef (This=0x862df8) returned 0x3 [0245.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0245.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0245.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x8bfe38) returned 0x0 [0245.812] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8bfe38, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0245.812] WbemDefPath:IUnknown:Release (This=0x8bfe38) returned 0x3 [0245.812] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0245.812] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0245.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x862df8, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0245.812] WbemDefPath:IUnknown:Release (This=0x862df8) returned 0x2 [0245.812] WbemDefPath:IUnknown:Release (This=0x862df8) returned 0x1 [0245.812] SetEvent (hEvent=0x440) returned 1 [0247.194] CoGetClassObject (in: rclsid=0x8883fc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e3f2c8 | out: ppv=0x4e3f2c8*=0x83c2b0) returned 0x0 [0247.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x83c2b0, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e3f4e0 | out: ppvObject=0x4e3f4e0*=0x0) returned 0x80004002 [0247.194] WbemDefPath:IClassFactory:CreateInstance (in: This=0x83c2b0, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f4f4 | out: ppvObject=0x4e3f4f4*=0x863178) returned 0x0 [0247.194] WbemDefPath:IUnknown:Release (This=0x83c2b0) returned 0x0 [0247.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x863178, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3f114 | out: ppvObject=0x4e3f114*=0x863178) returned 0x0 [0247.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x863178, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e3f0d0 | out: ppvObject=0x4e3f0d0*=0x0) returned 0x80004002 [0247.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x863178, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e3ecc4 | out: ppvObject=0x4e3ecc4*=0x0) returned 0x80004002 [0247.195] WbemDefPath:IUnknown:AddRef (This=0x863178) returned 0x3 [0247.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x863178, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e3ea2c | out: ppvObject=0x4e3ea2c*=0x0) returned 0x80004002 [0247.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x863178, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e3e9dc | out: ppvObject=0x4e3e9dc*=0x0) returned 0x80004002 [0247.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x863178, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3e9e8 | out: ppvObject=0x4e3e9e8*=0x898280) returned 0x0 [0247.195] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x898280, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e3e9f0 | out: pCid=0x4e3e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0247.195] WbemDefPath:IUnknown:Release (This=0x898280) returned 0x3 [0247.195] CoGetContextToken (in: pToken=0x4e3ea48 | out: pToken=0x4e3ea48) returned 0x0 [0247.195] CoGetContextToken (in: pToken=0x4e3ee50 | out: pToken=0x4e3ee50) returned 0x0 [0247.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x863178, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e3eee0 | out: ppvObject=0x4e3eee0*=0x0) returned 0x80004002 [0247.195] WbemDefPath:IUnknown:Release (This=0x863178) returned 0x2 [0247.195] WbemDefPath:IUnknown:Release (This=0x863178) returned 0x1 [0247.195] SetEvent (hEvent=0x3e0) returned 1 Thread: id = 126 os_tid = 0x13fc [0212.775] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0212.775] RoInitialize () returned 0x1 [0212.775] RoUninitialize () returned 0x0 [0212.775] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x4f7f7fc | out: lpiid=0x4f7f7fc) returned 0x0 [0212.776] CoGetClassObject (in: rclsid=0x88833c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4f7f510 | out: ppv=0x4f7f510*=0x885188) returned 0x0 [0212.777] WbemLocator:IUnknown:QueryInterface (in: This=0x885188, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4f7f728 | out: ppvObject=0x4f7f728*=0x0) returned 0x80004002 [0212.777] WbemLocator:IClassFactory:CreateInstance (in: This=0x885188, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f7f73c | out: ppvObject=0x4f7f73c*=0x887d78) returned 0x0 [0212.777] WbemLocator:IUnknown:Release (This=0x885188) returned 0x0 [0212.777] WbemLocator:IUnknown:QueryInterface (in: This=0x887d78, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f7f35c | out: ppvObject=0x4f7f35c*=0x887d78) returned 0x0 [0212.777] WbemLocator:IUnknown:QueryInterface (in: This=0x887d78, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4f7f318 | out: ppvObject=0x4f7f318*=0x0) returned 0x80004002 [0212.777] WbemLocator:IUnknown:QueryInterface (in: This=0x887d78, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4f7ef0c | out: ppvObject=0x4f7ef0c*=0x0) returned 0x80004002 [0212.777] WbemLocator:IUnknown:AddRef (This=0x887d78) returned 0x3 [0212.777] WbemLocator:IUnknown:QueryInterface (in: This=0x887d78, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4f7ec74 | out: ppvObject=0x4f7ec74*=0x0) returned 0x80004002 [0212.778] WbemLocator:IUnknown:QueryInterface (in: This=0x887d78, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4f7ec24 | out: ppvObject=0x4f7ec24*=0x0) returned 0x80004002 [0212.778] WbemLocator:IUnknown:QueryInterface (in: This=0x887d78, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f7ec30 | out: ppvObject=0x4f7ec30*=0x0) returned 0x80004002 [0212.778] CoGetContextToken (in: pToken=0x4f7ec90 | out: pToken=0x4f7ec90) returned 0x0 [0212.778] CoGetObjectContext (in: riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x884ff4 | out: ppv=0x884ff4*=0x810138) returned 0x0 [0212.779] CoGetContextToken (in: pToken=0x4f7f098 | out: pToken=0x4f7f098) returned 0x0 [0212.779] WbemLocator:IUnknown:QueryInterface (in: This=0x887d78, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f7f128 | out: ppvObject=0x4f7f128*=0x0) returned 0x80004002 [0212.779] WbemLocator:IUnknown:Release (This=0x887d78) returned 0x2 [0212.779] WbemLocator:IUnknown:Release (This=0x887d78) returned 0x1 [0212.780] CoGetContextToken (in: pToken=0x4f7f708 | out: pToken=0x4f7f708) returned 0x0 [0212.780] CoGetContextToken (in: pToken=0x4f7f668 | out: pToken=0x4f7f668) returned 0x0 [0212.780] WbemLocator:IUnknown:QueryInterface (in: This=0x887d78, riid=0x4f7f738*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x4f7f734 | out: ppvObject=0x4f7f734*=0x887d78) returned 0x0 [0212.780] WbemLocator:IUnknown:AddRef (This=0x887d78) returned 0x3 [0212.780] WbemLocator:IUnknown:Release (This=0x887d78) returned 0x2 [0212.782] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8828f0, puCount=0x4f7f8cc | out: puCount=0x4f7f8cc*=0x2) returned 0x0 [0212.782] WbemDefPath:IWbemPath:GetText (in: This=0x8828f0, lFlags=8, puBuffLength=0x4f7f8c8*=0x0, pszText=0x0 | out: puBuffLength=0x4f7f8c8*=0xf, pszText=0x0) returned 0x0 [0212.783] WbemDefPath:IWbemPath:GetText (in: This=0x8828f0, lFlags=8, puBuffLength=0x4f7f8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x4f7f8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0212.796] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x4f7eb4c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0212.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x4f7f050, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0212.798] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6c7e0000 [0213.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x4f7f084, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04XF\x88", lpUsedDefaultChar=0x0) returned 13 [0213.288] GetProcAddress (hModule=0x6c7e0000, lpProcName="ResetSecurity") returned 0x6c7e26fe [0213.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x4f7f084, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0213.300] GetProcAddress (hModule=0x6c7e0000, lpProcName="SetSecurity") returned 0x6c7e2740 [0213.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x4f7f080, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServices\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 18 [0213.314] GetProcAddress (hModule=0x6c7e0000, lpProcName="BlessIWbemServices") returned 0x6c7e1e89 [0213.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x4f7f078, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObjectD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 24 [0213.356] GetProcAddress (hModule=0x6c7e0000, lpProcName="BlessIWbemServicesObject") returned 0x6c7e1edb [0213.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x4f7f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 17 [0213.403] GetProcAddress (hModule=0x6c7e0000, lpProcName="GetPropertyHandle") returned 0x6c7e23d4 [0213.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x4f7f080, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValue\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 18 [0213.431] GetProcAddress (hModule=0x6c7e0000, lpProcName="WritePropertyValue") returned 0x6c7e2837 [0213.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4f7f08c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 5 [0213.448] GetProcAddress (hModule=0x6c7e0000, lpProcName="Clone") returned 0x6c7e1f2d [0213.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x4f7f080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0213.469] GetProcAddress (hModule=0x6c7e0000, lpProcName="VerifyClientKey") returned 0x6c7e27d4 [0213.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x4f7f080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0213.480] GetProcAddress (hModule=0x6c7e0000, lpProcName="GetQualifierSet") returned 0x6c7e2435 [0213.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x4f7f08c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0213.483] GetProcAddress (hModule=0x6c7e0000, lpProcName="Get") returned 0x6c7e22f4 [0213.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x4f7f08c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0213.514] GetProcAddress (hModule=0x6c7e0000, lpProcName="Put") returned 0x6c7e24de [0213.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x4f7f08c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Delete\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 6 [0213.544] GetProcAddress (hModule=0x6c7e0000, lpProcName="Delete") returned 0x6c7e2151 [0213.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x4f7f088, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNamesD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 8 [0213.564] GetProcAddress (hModule=0x6c7e0000, lpProcName="GetNames") returned 0x6c7e23a2 [0213.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x4f7f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumerationD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 16 [0213.611] GetProcAddress (hModule=0x6c7e0000, lpProcName="BeginEnumeration") returned 0x6c7e1e63 [0213.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x4f7f08c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 4 [0213.850] GetProcAddress (hModule=0x6c7e0000, lpProcName="Next") returned 0x6c7e24a3 [0214.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x4f7f084, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumeration\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 14 [0214.026] GetProcAddress (hModule=0x6c7e0000, lpProcName="EndEnumeration") returned 0x6c7e21e2 [0214.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x4f7f078, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0214.037] GetProcAddress (hModule=0x6c7e0000, lpProcName="GetPropertyQualifierSet") returned 0x6c7e241f [0214.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4f7f08c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 5 [0214.052] GetProcAddress (hModule=0x6c7e0000, lpProcName="Clone") returned 0x6c7e1f2d [0214.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x4f7f084, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 13 [0214.053] GetProcAddress (hModule=0x6c7e0000, lpProcName="GetObjectText") returned 0x6c7e23be [0214.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x4f7f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 17 [0214.109] GetProcAddress (hModule=0x6c7e0000, lpProcName="SpawnDerivedClass") returned 0x6c7e2786 [0214.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x4f7f084, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 13 [0214.120] GetProcAddress (hModule=0x6c7e0000, lpProcName="SpawnInstance") returned 0x6c7e279c [0214.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x4f7f088, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 9 [0214.122] GetProcAddress (hModule=0x6c7e0000, lpProcName="CompareTo") returned 0x6c7e1fad [0214.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x4f7f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 17 [0214.132] GetProcAddress (hModule=0x6c7e0000, lpProcName="GetPropertyOrigin") returned 0x6c7e2409 [0214.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x4f7f084, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFromD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 12 [0214.183] GetProcAddress (hModule=0x6c7e0000, lpProcName="InheritsFrom") returned 0x6c7e2448 [0214.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x4f7f088, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 9 [0214.184] GetProcAddress (hModule=0x6c7e0000, lpProcName="GetMethod") returned 0x6c7e235a [0214.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x4f7f088, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 9 [0214.200] GetProcAddress (hModule=0x6c7e0000, lpProcName="PutMethod") returned 0x6c7e25fa [0214.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x4f7f084, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethodD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 12 [0214.220] GetProcAddress (hModule=0x6c7e0000, lpProcName="DeleteMethod") returned 0x6c7e2164 [0214.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x4f7f07c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumeration\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 22 [0214.222] GetProcAddress (hModule=0x6c7e0000, lpProcName="BeginMethodEnumeration") returned 0x6c7e1e76 [0214.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x4f7f088, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethod\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 10 [0214.224] GetProcAddress (hModule=0x6c7e0000, lpProcName="NextMethod") returned 0x6c7e24c2 [0214.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x4f7f07c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumerationD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 20 [0214.239] GetProcAddress (hModule=0x6c7e0000, lpProcName="EndMethodEnumeration") returned 0x6c7e21f2 [0214.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x4f7f07c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 21 [0214.241] GetProcAddress (hModule=0x6c7e0000, lpProcName="GetMethodQualifierSet") returned 0x6c7e238c [0214.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x4f7f080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0214.242] GetProcAddress (hModule=0x6c7e0000, lpProcName="GetMethodOrigin") returned 0x6c7e2376 [0214.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x4f7f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 16 [0214.244] GetProcAddress (hModule=0x6c7e0000, lpProcName="QualifierSet_Get") returned 0x6c7e264c [0214.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x4f7f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_PutD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 16 [0214.638] GetProcAddress (hModule=0x6c7e0000, lpProcName="QualifierSet_Put") returned 0x6c7e269a [0214.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x4f7f07c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0214.772] GetProcAddress (hModule=0x6c7e0000, lpProcName="QualifierSet_Delete") returned 0x6c7e2629 [0214.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x4f7f07c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 21 [0214.774] GetProcAddress (hModule=0x6c7e0000, lpProcName="QualifierSet_GetNames") returned 0x6c7e2668 [0214.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x4f7f074, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 29 [0214.820] GetProcAddress (hModule=0x6c7e0000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6c7e2616 [0214.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x4f7f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 17 [0214.822] GetProcAddress (hModule=0x6c7e0000, lpProcName="QualifierSet_Next") returned 0x6c7e267e [0214.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x4f7f074, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27 [0214.849] GetProcAddress (hModule=0x6c7e0000, lpProcName="QualifierSet_EndEnumeration") returned 0x6c7e263c [0214.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x4f7f078, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0214.851] GetProcAddress (hModule=0x6c7e0000, lpProcName="GetCurrentApartmentType") returned 0x6c7e2435 [0214.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x4f7f07c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStubD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 20 [0214.870] GetProcAddress (hModule=0x6c7e0000, lpProcName="GetDemultiplexedStub") returned 0x6c7e2313 [0214.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x4f7f07c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 21 [0214.884] GetProcAddress (hModule=0x6c7e0000, lpProcName="CreateInstanceEnumWmi") returned 0x6c7e20db [0214.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x4f7f080, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmi\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 18 [0214.922] GetProcAddress (hModule=0x6c7e0000, lpProcName="CreateClassEnumWmi") returned 0x6c7e2065 [0214.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x4f7f084, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmiD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 12 [0214.924] GetProcAddress (hModule=0x6c7e0000, lpProcName="ExecQueryWmi") returned 0x6c7e227b [0214.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x4f7f078, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmiD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 24 [0214.960] GetProcAddress (hModule=0x6c7e0000, lpProcName="ExecNotificationQueryWmi") returned 0x6c7e2202 [0214.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x4f7f084, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmi\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 14 [0214.962] GetProcAddress (hModule=0x6c7e0000, lpProcName="PutInstanceWmi") returned 0x6c7e257a [0214.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x4f7f084, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11 [0214.992] GetProcAddress (hModule=0x6c7e0000, lpProcName="PutClassWmi") returned 0x6c7e24fa [0214.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x4f7f078, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObjectD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 24 [0214.993] GetProcAddress (hModule=0x6c7e0000, lpProcName="CloneEnumWbemClassObject") returned 0x6c7e1f40 [0215.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x4f7f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmiD\x1a\x9fkÀ<ÓÍ «\"kHó÷\x04", lpUsedDefaultChar=0x0) returned 16 [0215.042] GetProcAddress (hModule=0x6c7e0000, lpProcName="ConnectServerWmi") returned 0x6c7e1fc3 [0215.060] CoCreateInstance (in: rclsid=0x6c7e1284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c7e12e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4f7f7a4 | out: ppv=0x4f7f7a4*=0x887df8) returned 0x0 [0215.060] WbemLocator:IWbemLocator:ConnectServer (in: This=0x887df8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x4f7f838 | out: ppNamespace=0x4f7f838*=0x804420) returned 0x0 [0215.333] WbemLocator:IUnknown:QueryInterface (in: This=0x804420, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f7f6d4 | out: ppvObject=0x4f7f6d4*=0x835c1c) returned 0x0 [0215.334] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x835c1c, pProxy=0x804420, pAuthnSvc=0x4f7f724, pAuthzSvc=0x4f7f720, pServerPrincName=0x4f7f718, pAuthnLevel=0x4f7f71c, pImpLevel=0x4f7f70c, pAuthInfo=0x4f7f710, pCapabilites=0x4f7f714 | out: pAuthnSvc=0x4f7f724*=0xa, pAuthzSvc=0x4f7f720*=0x0, pServerPrincName=0x4f7f718, pAuthnLevel=0x4f7f71c*=0x6, pImpLevel=0x4f7f70c*=0x2, pAuthInfo=0x4f7f710, pCapabilites=0x4f7f714*=0x1) returned 0x0 [0215.334] WbemLocator:IUnknown:Release (This=0x835c1c) returned 0x1 [0215.334] WbemLocator:IUnknown:QueryInterface (in: This=0x804420, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f7f6c8 | out: ppvObject=0x4f7f6c8*=0x835c40) returned 0x0 [0215.334] WbemLocator:IUnknown:QueryInterface (in: This=0x804420, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f7f6c4 | out: ppvObject=0x4f7f6c4*=0x835c1c) returned 0x0 [0215.334] WbemLocator:IClientSecurity:SetBlanket (This=0x835c1c, pProxy=0x804420, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0215.334] WbemLocator:IUnknown:Release (This=0x835c1c) returned 0x2 [0215.334] WbemLocator:IUnknown:Release (This=0x835c40) returned 0x1 [0215.334] CoTaskMemFree (pv=0x8880f0) [0215.334] WbemLocator:IUnknown:Release (This=0x887df8) returned 0x0 [0215.334] WbemLocator:IUnknown:QueryInterface (in: This=0x804420, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f7f2c4 | out: ppvObject=0x4f7f2c4*=0x835c40) returned 0x0 [0215.335] WbemLocator:IUnknown:QueryInterface (in: This=0x835c40, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4f7f280 | out: ppvObject=0x4f7f280*=0x0) returned 0x80004002 [0215.342] WbemLocator:IUnknown:QueryInterface (in: This=0x835c40, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4f7f09c | out: ppvObject=0x4f7f09c*=0x0) returned 0x80004002 [0215.345] WbemLocator:IUnknown:QueryInterface (in: This=0x804420, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4f7ee74 | out: ppvObject=0x4f7ee74*=0x0) returned 0x80004002 [0215.365] WbemLocator:IUnknown:AddRef (This=0x835c40) returned 0x3 [0215.365] WbemLocator:IUnknown:QueryInterface (in: This=0x835c40, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4f7ebdc | out: ppvObject=0x4f7ebdc*=0x0) returned 0x80004002 [0215.365] WbemLocator:IUnknown:QueryInterface (in: This=0x835c40, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4f7eb8c | out: ppvObject=0x4f7eb8c*=0x0) returned 0x80004002 [0215.365] WbemLocator:IUnknown:QueryInterface (in: This=0x835c40, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f7eb98 | out: ppvObject=0x4f7eb98*=0x835b9c) returned 0x0 [0215.366] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x835b9c, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4f7eba0 | out: pCid=0x4f7eba0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0215.366] WbemLocator:IUnknown:Release (This=0x835b9c) returned 0x3 [0215.366] CoGetContextToken (in: pToken=0x4f7ebf8 | out: pToken=0x4f7ebf8) returned 0x0 [0215.366] CoGetContextToken (in: pToken=0x4f7f000 | out: pToken=0x4f7f000) returned 0x0 [0215.366] WbemLocator:IUnknown:QueryInterface (in: This=0x835c40, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f7f090 | out: ppvObject=0x4f7f090*=0x835c24) returned 0x0 [0215.367] WbemLocator:IRpcOptions:Query (in: This=0x835c24, pPrx=0x835c40, dwProperty=2, pdwValue=0x4f7f0b8 | out: pdwValue=0x4f7f0b8) returned 0x80004002 [0215.367] WbemLocator:IUnknown:Release (This=0x835c24) returned 0x3 [0215.367] WbemLocator:IUnknown:Release (This=0x835c40) returned 0x2 [0215.367] CoGetContextToken (in: pToken=0x4f7f5d8 | out: pToken=0x4f7f5d8) returned 0x0 [0215.367] CoGetContextToken (in: pToken=0x4f7f538 | out: pToken=0x4f7f538) returned 0x0 [0215.367] WbemLocator:IUnknown:QueryInterface (in: This=0x835c40, riid=0x4f7f608*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x4f7f604 | out: ppvObject=0x4f7f604*=0x804420) returned 0x0 [0215.367] WbemLocator:IUnknown:AddRef (This=0x804420) returned 0x4 [0215.374] WbemLocator:IUnknown:Release (This=0x804420) returned 0x3 [0215.374] WbemLocator:IUnknown:Release (This=0x804420) returned 0x2 [0215.380] SysStringLen (param_1=0x0) returned 0x0 [0215.381] CoUninitialize () Thread: id = 127 os_tid = 0x6a4 [0215.473] CoGetContextToken (in: pToken=0x4f7f26c | out: pToken=0x4f7f26c) returned 0x0 [0215.473] CoGetContextToken (in: pToken=0x4f7f25c | out: pToken=0x4f7f25c) returned 0x0 [0215.473] CoGetMarshalSizeMax (in: pulSize=0x4f7f218, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x835c40, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f7f218) returned 0x0 [0215.474] CoMarshalInterface (pStm=0x865530, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x835c40, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0234.359] CoGetContextToken (in: pToken=0x4f7f26c | out: pToken=0x4f7f26c) returned 0x0 [0234.359] CoGetContextToken (in: pToken=0x4f7f25c | out: pToken=0x4f7f25c) returned 0x0 [0234.359] CoGetMarshalSizeMax (in: pulSize=0x4f7f218, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x836440, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f7f218) returned 0x0 [0234.360] CoMarshalInterface (pStm=0x865610, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x836440, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0244.137] CoGetContextToken (in: pToken=0x4f7f26c | out: pToken=0x4f7f26c) returned 0x0 [0244.137] CoGetContextToken (in: pToken=0x4f7f25c | out: pToken=0x4f7f25c) returned 0x0 [0244.137] CoGetMarshalSizeMax (in: pulSize=0x4f7f218, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x89cc08, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f7f218) returned 0x0 [0244.137] CoMarshalInterface (pStm=0x865790, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x89cc08, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0244.546] CoGetContextToken (in: pToken=0x4f7f26c | out: pToken=0x4f7f26c) returned 0x0 [0244.546] CoGetContextToken (in: pToken=0x4f7f25c | out: pToken=0x4f7f25c) returned 0x0 [0244.546] CoGetMarshalSizeMax (in: pulSize=0x4f7f218, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x89cd08, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f7f218) returned 0x0 [0244.546] CoMarshalInterface (pStm=0x865730, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x89cd08, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0245.996] CoGetContextToken (in: pToken=0x4f7f26c | out: pToken=0x4f7f26c) returned 0x0 [0245.996] CoGetContextToken (in: pToken=0x4f7f25c | out: pToken=0x4f7f25c) returned 0x0 [0245.996] CoGetMarshalSizeMax (in: pulSize=0x4f7f218, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x89ce08, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f7f218) returned 0x0 [0245.996] CoMarshalInterface (pStm=0x8655d0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x89ce08, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 Thread: id = 128 os_tid = 0x6d0 [0234.311] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0234.311] RoInitialize () returned 0x1 [0234.311] RoUninitialize () returned 0x0 [0234.313] CoGetClassObject (in: rclsid=0x88833c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x50bf490 | out: ppv=0x50bf490*=0x897ff8) returned 0x0 [0234.313] WbemLocator:IUnknown:QueryInterface (in: This=0x897ff8, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x50bf6a8 | out: ppvObject=0x50bf6a8*=0x0) returned 0x80004002 [0234.313] WbemLocator:IClassFactory:CreateInstance (in: This=0x897ff8, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50bf6bc | out: ppvObject=0x50bf6bc*=0x887e28) returned 0x0 [0234.313] WbemLocator:IUnknown:Release (This=0x897ff8) returned 0x0 [0234.313] WbemLocator:IUnknown:QueryInterface (in: This=0x887e28, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50bf2dc | out: ppvObject=0x50bf2dc*=0x887e28) returned 0x0 [0234.314] WbemLocator:IUnknown:QueryInterface (in: This=0x887e28, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x50bf298 | out: ppvObject=0x50bf298*=0x0) returned 0x80004002 [0234.314] WbemLocator:IUnknown:QueryInterface (in: This=0x887e28, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x50bee8c | out: ppvObject=0x50bee8c*=0x0) returned 0x80004002 [0234.314] WbemLocator:IUnknown:AddRef (This=0x887e28) returned 0x3 [0234.314] WbemLocator:IUnknown:QueryInterface (in: This=0x887e28, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x50bebf4 | out: ppvObject=0x50bebf4*=0x0) returned 0x80004002 [0234.314] WbemLocator:IUnknown:QueryInterface (in: This=0x887e28, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x50beba4 | out: ppvObject=0x50beba4*=0x0) returned 0x80004002 [0234.314] WbemLocator:IUnknown:QueryInterface (in: This=0x887e28, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50bebb0 | out: ppvObject=0x50bebb0*=0x0) returned 0x80004002 [0234.314] CoGetContextToken (in: pToken=0x50bec10 | out: pToken=0x50bec10) returned 0x0 [0234.316] CoGetContextToken (in: pToken=0x50bf018 | out: pToken=0x50bf018) returned 0x0 [0234.316] WbemLocator:IUnknown:QueryInterface (in: This=0x887e28, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50bf0a8 | out: ppvObject=0x50bf0a8*=0x0) returned 0x80004002 [0234.316] WbemLocator:IUnknown:Release (This=0x887e28) returned 0x2 [0234.316] WbemLocator:IUnknown:Release (This=0x887e28) returned 0x1 [0234.316] CoGetContextToken (in: pToken=0x50bf688 | out: pToken=0x50bf688) returned 0x0 [0234.316] CoGetContextToken (in: pToken=0x50bf5e8 | out: pToken=0x50bf5e8) returned 0x0 [0234.316] WbemLocator:IUnknown:QueryInterface (in: This=0x887e28, riid=0x50bf6b8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x50bf6b4 | out: ppvObject=0x50bf6b4*=0x887e28) returned 0x0 [0234.317] WbemLocator:IUnknown:AddRef (This=0x887e28) returned 0x3 [0234.317] WbemLocator:IUnknown:Release (This=0x887e28) returned 0x2 [0234.317] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x863098, puCount=0x50bf84c | out: puCount=0x50bf84c*=0x2) returned 0x0 [0234.317] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=8, puBuffLength=0x50bf848*=0x0, pszText=0x0 | out: puBuffLength=0x50bf848*=0xf, pszText=0x0) returned 0x0 [0234.317] WbemDefPath:IWbemPath:GetText (in: This=0x863098, lFlags=8, puBuffLength=0x50bf848*=0xf, pszText="00000000000000" | out: puBuffLength=0x50bf848*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.317] CoCreateInstance (in: rclsid=0x6c7e1284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c7e12e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x50bf724 | out: ppv=0x50bf724*=0x887ea8) returned 0x0 [0234.317] WbemLocator:IWbemLocator:ConnectServer (in: This=0x887ea8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x50bf7b8 | out: ppNamespace=0x50bf7b8*=0x8a4268) returned 0x0 [0234.351] WbemLocator:IUnknown:QueryInterface (in: This=0x8a4268, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50bf654 | out: ppvObject=0x50bf654*=0x83641c) returned 0x0 [0234.351] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x83641c, pProxy=0x8a4268, pAuthnSvc=0x50bf6a4, pAuthzSvc=0x50bf6a0, pServerPrincName=0x50bf698, pAuthnLevel=0x50bf69c, pImpLevel=0x50bf68c, pAuthInfo=0x50bf690, pCapabilites=0x50bf694 | out: pAuthnSvc=0x50bf6a4*=0xa, pAuthzSvc=0x50bf6a0*=0x0, pServerPrincName=0x50bf698, pAuthnLevel=0x50bf69c*=0x6, pImpLevel=0x50bf68c*=0x2, pAuthInfo=0x50bf690, pCapabilites=0x50bf694*=0x1) returned 0x0 [0234.351] WbemLocator:IUnknown:Release (This=0x83641c) returned 0x1 [0234.351] WbemLocator:IUnknown:QueryInterface (in: This=0x8a4268, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50bf648 | out: ppvObject=0x50bf648*=0x836440) returned 0x0 [0234.351] WbemLocator:IUnknown:QueryInterface (in: This=0x8a4268, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50bf644 | out: ppvObject=0x50bf644*=0x83641c) returned 0x0 [0234.351] WbemLocator:IClientSecurity:SetBlanket (This=0x83641c, pProxy=0x8a4268, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0234.351] WbemLocator:IUnknown:Release (This=0x83641c) returned 0x2 [0234.351] WbemLocator:IUnknown:Release (This=0x836440) returned 0x1 [0234.352] CoTaskMemFree (pv=0x888480) [0234.352] WbemLocator:IUnknown:Release (This=0x887ea8) returned 0x0 [0234.352] WbemLocator:IUnknown:QueryInterface (in: This=0x8a4268, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50bf244 | out: ppvObject=0x50bf244*=0x836440) returned 0x0 [0234.352] WbemLocator:IUnknown:QueryInterface (in: This=0x836440, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x50bf200 | out: ppvObject=0x50bf200*=0x0) returned 0x80004002 [0234.352] WbemLocator:IUnknown:QueryInterface (in: This=0x836440, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x50bf01c | out: ppvObject=0x50bf01c*=0x0) returned 0x80004002 [0234.353] WbemLocator:IUnknown:QueryInterface (in: This=0x8a4268, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x50bedf4 | out: ppvObject=0x50bedf4*=0x0) returned 0x80004002 [0234.353] WbemLocator:IUnknown:AddRef (This=0x836440) returned 0x3 [0234.353] WbemLocator:IUnknown:QueryInterface (in: This=0x836440, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x50beb5c | out: ppvObject=0x50beb5c*=0x0) returned 0x80004002 [0234.353] WbemLocator:IUnknown:QueryInterface (in: This=0x836440, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x50beb0c | out: ppvObject=0x50beb0c*=0x0) returned 0x80004002 [0234.353] WbemLocator:IUnknown:QueryInterface (in: This=0x836440, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50beb18 | out: ppvObject=0x50beb18*=0x83639c) returned 0x0 [0234.353] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x83639c, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x50beb20 | out: pCid=0x50beb20*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.354] WbemLocator:IUnknown:Release (This=0x83639c) returned 0x3 [0234.354] CoGetContextToken (in: pToken=0x50beb78 | out: pToken=0x50beb78) returned 0x0 [0234.354] CoGetContextToken (in: pToken=0x50bef80 | out: pToken=0x50bef80) returned 0x0 [0234.354] WbemLocator:IUnknown:QueryInterface (in: This=0x836440, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x50bf010 | out: ppvObject=0x50bf010*=0x836424) returned 0x0 [0234.354] WbemLocator:IRpcOptions:Query (in: This=0x836424, pPrx=0x836440, dwProperty=2, pdwValue=0x50bf038 | out: pdwValue=0x50bf038) returned 0x80004002 [0234.354] WbemLocator:IUnknown:Release (This=0x836424) returned 0x3 [0234.354] WbemLocator:IUnknown:Release (This=0x836440) returned 0x2 [0234.354] CoGetContextToken (in: pToken=0x50bf558 | out: pToken=0x50bf558) returned 0x0 [0234.354] CoGetContextToken (in: pToken=0x50bf4b8 | out: pToken=0x50bf4b8) returned 0x0 [0234.355] WbemLocator:IUnknown:QueryInterface (in: This=0x836440, riid=0x50bf588*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x50bf584 | out: ppvObject=0x50bf584*=0x8a4268) returned 0x0 [0234.355] WbemLocator:IUnknown:AddRef (This=0x8a4268) returned 0x4 [0234.355] WbemLocator:IUnknown:Release (This=0x8a4268) returned 0x3 [0234.355] WbemLocator:IUnknown:Release (This=0x8a4268) returned 0x2 [0234.355] SysStringLen (param_1=0x0) returned 0x0 [0234.355] CoUninitialize () Thread: id = 134 os_tid = 0xcf0 [0235.016] CoGetContextToken (in: pToken=0x4fffebc | out: pToken=0x4fffebc) returned 0x0 [0235.016] IUnknown:QueryInterface (in: This=0x810138, riid=0x6b2b4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4fffee0 | out: ppvObject=0x4fffee0*=0x810144) returned 0x0 [0235.049] IComThreadingInfo:GetCurrentThreadType (in: This=0x810144, pThreadType=0x4ffff0c | out: pThreadType=0x4ffff0c*=0) returned 0x0 [0235.049] IUnknown:Release (This=0x810144) returned 0x1 [0235.049] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0235.049] RoInitialize () returned 0x1 [0235.049] RoUninitialize () returned 0x0 Thread: id = 135 os_tid = 0x1390 [0236.233] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0236.233] CoGetContextToken (in: pToken=0x513fbc4 | out: pToken=0x513fbc4) returned 0x0 [0236.233] IUnknown:QueryInterface (in: This=0x810138, riid=0x6b2b4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x513fbe8 | out: ppvObject=0x513fbe8*=0x810144) returned 0x0 [0236.233] IComThreadingInfo:GetCurrentThreadType (in: This=0x810144, pThreadType=0x513fc14 | out: pThreadType=0x513fc14*=0) returned 0x0 [0236.233] IUnknown:Release (This=0x810144) returned 0x1 [0236.234] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0236.234] CoUninitialize () [0236.234] RoInitialize () returned 0x1 [0236.234] RoUninitialize () returned 0x0 [0236.234] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x513f8d4 | out: UnbiasedTime=0x513f8d4) returned 1 [0236.234] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x513f8c4 | out: UnbiasedTime=0x513f8c4) returned 1 [0258.629] CoUninitialize () Thread: id = 136 os_tid = 0xef0 Thread: id = 137 os_tid = 0x1380 [0244.018] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0244.018] RoInitialize () returned 0x1 [0244.018] RoUninitialize () returned 0x0 [0244.019] CoGetClassObject (in: rclsid=0x88833c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x549f390 | out: ppv=0x549f390*=0x8c1350) returned 0x0 [0244.020] WbemLocator:IUnknown:QueryInterface (in: This=0x8c1350, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x549f5a8 | out: ppvObject=0x549f5a8*=0x0) returned 0x80004002 [0244.020] WbemLocator:IClassFactory:CreateInstance (in: This=0x8c1350, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x549f5bc | out: ppvObject=0x549f5bc*=0x887e98) returned 0x0 [0244.020] WbemLocator:IUnknown:Release (This=0x8c1350) returned 0x0 [0244.020] WbemLocator:IUnknown:QueryInterface (in: This=0x887e98, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x549f1dc | out: ppvObject=0x549f1dc*=0x887e98) returned 0x0 [0244.021] WbemLocator:IUnknown:QueryInterface (in: This=0x887e98, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x549f198 | out: ppvObject=0x549f198*=0x0) returned 0x80004002 [0244.021] WbemLocator:IUnknown:QueryInterface (in: This=0x887e98, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x549ed8c | out: ppvObject=0x549ed8c*=0x0) returned 0x80004002 [0244.021] WbemLocator:IUnknown:AddRef (This=0x887e98) returned 0x3 [0244.021] WbemLocator:IUnknown:QueryInterface (in: This=0x887e98, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x549eaf4 | out: ppvObject=0x549eaf4*=0x0) returned 0x80004002 [0244.021] WbemLocator:IUnknown:QueryInterface (in: This=0x887e98, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x549eaa4 | out: ppvObject=0x549eaa4*=0x0) returned 0x80004002 [0244.021] WbemLocator:IUnknown:QueryInterface (in: This=0x887e98, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x549eab0 | out: ppvObject=0x549eab0*=0x0) returned 0x80004002 [0244.021] CoGetContextToken (in: pToken=0x549eb10 | out: pToken=0x549eb10) returned 0x0 [0244.023] CoGetContextToken (in: pToken=0x549ef18 | out: pToken=0x549ef18) returned 0x0 [0244.023] WbemLocator:IUnknown:QueryInterface (in: This=0x887e98, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x549efa8 | out: ppvObject=0x549efa8*=0x0) returned 0x80004002 [0244.023] WbemLocator:IUnknown:Release (This=0x887e98) returned 0x2 [0244.023] WbemLocator:IUnknown:Release (This=0x887e98) returned 0x1 [0244.023] CoGetContextToken (in: pToken=0x549f588 | out: pToken=0x549f588) returned 0x0 [0244.023] CoGetContextToken (in: pToken=0x549f4e8 | out: pToken=0x549f4e8) returned 0x0 [0244.023] WbemLocator:IUnknown:QueryInterface (in: This=0x887e98, riid=0x549f5b8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x549f5b4 | out: ppvObject=0x549f5b4*=0x887e98) returned 0x0 [0244.023] WbemLocator:IUnknown:AddRef (This=0x887e98) returned 0x3 [0244.023] WbemLocator:IUnknown:Release (This=0x887e98) returned 0x2 [0244.024] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x549f74c | out: puCount=0x549f74c*=0x2) returned 0x0 [0244.024] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=8, puBuffLength=0x549f748*=0x0, pszText=0x0 | out: puBuffLength=0x549f748*=0xf, pszText=0x0) returned 0x0 [0244.024] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=8, puBuffLength=0x549f748*=0xf, pszText="00000000000000" | out: puBuffLength=0x549f748*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0244.024] CoCreateInstance (in: rclsid=0x6c7e1284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c7e12e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x549f624 | out: ppv=0x549f624*=0x887dd8) returned 0x0 [0244.024] WbemLocator:IWbemLocator:ConnectServer (in: This=0x887dd8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x549f6b8 | out: ppNamespace=0x549f6b8*=0x8a3f98) returned 0x0 [0244.110] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3f98, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x549f554 | out: ppvObject=0x549f554*=0x89cbe4) returned 0x0 [0244.110] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89cbe4, pProxy=0x8a3f98, pAuthnSvc=0x549f5a4, pAuthzSvc=0x549f5a0, pServerPrincName=0x549f598, pAuthnLevel=0x549f59c, pImpLevel=0x549f58c, pAuthInfo=0x549f590, pCapabilites=0x549f594 | out: pAuthnSvc=0x549f5a4*=0xa, pAuthzSvc=0x549f5a0*=0x0, pServerPrincName=0x549f598, pAuthnLevel=0x549f59c*=0x6, pImpLevel=0x549f58c*=0x2, pAuthInfo=0x549f590, pCapabilites=0x549f594*=0x1) returned 0x0 [0244.110] WbemLocator:IUnknown:Release (This=0x89cbe4) returned 0x1 [0244.110] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3f98, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x549f548 | out: ppvObject=0x549f548*=0x89cc08) returned 0x0 [0244.110] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3f98, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x549f544 | out: ppvObject=0x549f544*=0x89cbe4) returned 0x0 [0244.110] WbemLocator:IClientSecurity:SetBlanket (This=0x89cbe4, pProxy=0x8a3f98, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0244.111] WbemLocator:IUnknown:Release (This=0x89cbe4) returned 0x2 [0244.111] WbemLocator:IUnknown:Release (This=0x89cc08) returned 0x1 [0244.111] CoTaskMemFree (pv=0x86f3f0) [0244.111] WbemLocator:IUnknown:Release (This=0x887dd8) returned 0x0 [0244.111] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3f98, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x549f144 | out: ppvObject=0x549f144*=0x89cc08) returned 0x0 [0244.111] WbemLocator:IUnknown:QueryInterface (in: This=0x89cc08, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x549f100 | out: ppvObject=0x549f100*=0x0) returned 0x80004002 [0244.113] WbemLocator:IUnknown:QueryInterface (in: This=0x89cc08, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x549ef1c | out: ppvObject=0x549ef1c*=0x0) returned 0x80004002 [0244.127] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3f98, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x549ecf4 | out: ppvObject=0x549ecf4*=0x0) returned 0x80004002 [0244.128] WbemLocator:IUnknown:AddRef (This=0x89cc08) returned 0x3 [0244.128] WbemLocator:IUnknown:QueryInterface (in: This=0x89cc08, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x549ea5c | out: ppvObject=0x549ea5c*=0x0) returned 0x80004002 [0244.128] WbemLocator:IUnknown:QueryInterface (in: This=0x89cc08, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x549ea0c | out: ppvObject=0x549ea0c*=0x0) returned 0x80004002 [0244.128] WbemLocator:IUnknown:QueryInterface (in: This=0x89cc08, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x549ea18 | out: ppvObject=0x549ea18*=0x89cb64) returned 0x0 [0244.129] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89cb64, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x549ea20 | out: pCid=0x549ea20*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0244.129] WbemLocator:IUnknown:Release (This=0x89cb64) returned 0x3 [0244.129] CoGetContextToken (in: pToken=0x549ea78 | out: pToken=0x549ea78) returned 0x0 [0244.129] CoGetContextToken (in: pToken=0x549ee80 | out: pToken=0x549ee80) returned 0x0 [0244.129] WbemLocator:IUnknown:QueryInterface (in: This=0x89cc08, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x549ef10 | out: ppvObject=0x549ef10*=0x89cbec) returned 0x0 [0244.129] WbemLocator:IRpcOptions:Query (in: This=0x89cbec, pPrx=0x89cc08, dwProperty=2, pdwValue=0x549ef38 | out: pdwValue=0x549ef38) returned 0x80004002 [0244.129] WbemLocator:IUnknown:Release (This=0x89cbec) returned 0x3 [0244.129] WbemLocator:IUnknown:Release (This=0x89cc08) returned 0x2 [0244.129] CoGetContextToken (in: pToken=0x549f458 | out: pToken=0x549f458) returned 0x0 [0244.129] CoGetContextToken (in: pToken=0x549f3b8 | out: pToken=0x549f3b8) returned 0x0 [0244.129] WbemLocator:IUnknown:QueryInterface (in: This=0x89cc08, riid=0x549f488*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x549f484 | out: ppvObject=0x549f484*=0x8a3f98) returned 0x0 [0244.130] WbemLocator:IUnknown:AddRef (This=0x8a3f98) returned 0x4 [0244.130] WbemLocator:IUnknown:Release (This=0x8a3f98) returned 0x3 [0244.130] WbemLocator:IUnknown:Release (This=0x8a3f98) returned 0x2 [0244.130] SysStringLen (param_1=0x0) returned 0x0 [0244.130] CoUninitialize () Thread: id = 138 os_tid = 0x13bc [0244.497] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0244.497] RoInitialize () returned 0x1 [0244.497] RoUninitialize () returned 0x0 [0244.502] CoGetClassObject (in: rclsid=0x88833c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f310 | out: ppv=0x545f310*=0x8c0408) returned 0x0 [0244.503] WbemLocator:IUnknown:QueryInterface (in: This=0x8c0408, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f528 | out: ppvObject=0x545f528*=0x0) returned 0x80004002 [0244.503] WbemLocator:IClassFactory:CreateInstance (in: This=0x8c0408, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f53c | out: ppvObject=0x545f53c*=0x887c78) returned 0x0 [0244.503] WbemLocator:IUnknown:Release (This=0x8c0408) returned 0x0 [0244.503] WbemLocator:IUnknown:QueryInterface (in: This=0x887c78, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f15c | out: ppvObject=0x545f15c*=0x887c78) returned 0x0 [0244.503] WbemLocator:IUnknown:QueryInterface (in: This=0x887c78, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545f118 | out: ppvObject=0x545f118*=0x0) returned 0x80004002 [0244.503] WbemLocator:IUnknown:QueryInterface (in: This=0x887c78, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x545ed0c | out: ppvObject=0x545ed0c*=0x0) returned 0x80004002 [0244.503] WbemLocator:IUnknown:AddRef (This=0x887c78) returned 0x3 [0244.503] WbemLocator:IUnknown:QueryInterface (in: This=0x887c78, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545ea74 | out: ppvObject=0x545ea74*=0x0) returned 0x80004002 [0244.503] WbemLocator:IUnknown:QueryInterface (in: This=0x887c78, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545ea24 | out: ppvObject=0x545ea24*=0x0) returned 0x80004002 [0244.503] WbemLocator:IUnknown:QueryInterface (in: This=0x887c78, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545ea30 | out: ppvObject=0x545ea30*=0x0) returned 0x80004002 [0244.503] CoGetContextToken (in: pToken=0x545ea90 | out: pToken=0x545ea90) returned 0x0 [0244.505] CoGetContextToken (in: pToken=0x545ee98 | out: pToken=0x545ee98) returned 0x0 [0244.505] WbemLocator:IUnknown:QueryInterface (in: This=0x887c78, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545ef28 | out: ppvObject=0x545ef28*=0x0) returned 0x80004002 [0244.505] WbemLocator:IUnknown:Release (This=0x887c78) returned 0x2 [0244.505] WbemLocator:IUnknown:Release (This=0x887c78) returned 0x1 [0244.505] CoGetContextToken (in: pToken=0x545f508 | out: pToken=0x545f508) returned 0x0 [0244.506] CoGetContextToken (in: pToken=0x545f468 | out: pToken=0x545f468) returned 0x0 [0244.506] WbemLocator:IUnknown:QueryInterface (in: This=0x887c78, riid=0x545f538*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x545f534 | out: ppvObject=0x545f534*=0x887c78) returned 0x0 [0244.506] WbemLocator:IUnknown:AddRef (This=0x887c78) returned 0x3 [0244.506] WbemLocator:IUnknown:Release (This=0x887c78) returned 0x2 [0244.506] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x545f6cc | out: puCount=0x545f6cc*=0x2) returned 0x0 [0244.506] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=8, puBuffLength=0x545f6c8*=0x0, pszText=0x0 | out: puBuffLength=0x545f6c8*=0xf, pszText=0x0) returned 0x0 [0244.506] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=8, puBuffLength=0x545f6c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x545f6c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0244.506] CoCreateInstance (in: rclsid=0x6c7e1284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c7e12e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x545f5a4 | out: ppv=0x545f5a4*=0x887b78) returned 0x0 [0244.506] WbemLocator:IWbemLocator:ConnectServer (in: This=0x887b78, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x545f638 | out: ppNamespace=0x545f638*=0x8a40d8) returned 0x0 [0244.531] WbemLocator:IUnknown:QueryInterface (in: This=0x8a40d8, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f4d4 | out: ppvObject=0x545f4d4*=0x89cce4) returned 0x0 [0244.531] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89cce4, pProxy=0x8a40d8, pAuthnSvc=0x545f524, pAuthzSvc=0x545f520, pServerPrincName=0x545f518, pAuthnLevel=0x545f51c, pImpLevel=0x545f50c, pAuthInfo=0x545f510, pCapabilites=0x545f514 | out: pAuthnSvc=0x545f524*=0xa, pAuthzSvc=0x545f520*=0x0, pServerPrincName=0x545f518, pAuthnLevel=0x545f51c*=0x6, pImpLevel=0x545f50c*=0x2, pAuthInfo=0x545f510, pCapabilites=0x545f514*=0x1) returned 0x0 [0244.531] WbemLocator:IUnknown:Release (This=0x89cce4) returned 0x1 [0244.532] WbemLocator:IUnknown:QueryInterface (in: This=0x8a40d8, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f4c8 | out: ppvObject=0x545f4c8*=0x89cd08) returned 0x0 [0244.532] WbemLocator:IUnknown:QueryInterface (in: This=0x8a40d8, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f4c4 | out: ppvObject=0x545f4c4*=0x89cce4) returned 0x0 [0244.532] WbemLocator:IClientSecurity:SetBlanket (This=0x89cce4, pProxy=0x8a40d8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0244.532] WbemLocator:IUnknown:Release (This=0x89cce4) returned 0x2 [0244.532] WbemLocator:IUnknown:Release (This=0x89cd08) returned 0x1 [0244.532] CoTaskMemFree (pv=0x86f6c0) [0244.532] WbemLocator:IUnknown:Release (This=0x887b78) returned 0x0 [0244.532] WbemLocator:IUnknown:QueryInterface (in: This=0x8a40d8, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f0c4 | out: ppvObject=0x545f0c4*=0x89cd08) returned 0x0 [0244.532] WbemLocator:IUnknown:QueryInterface (in: This=0x89cd08, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545f080 | out: ppvObject=0x545f080*=0x0) returned 0x80004002 [0244.535] WbemLocator:IUnknown:QueryInterface (in: This=0x89cd08, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545ee9c | out: ppvObject=0x545ee9c*=0x0) returned 0x80004002 [0244.536] WbemLocator:IUnknown:QueryInterface (in: This=0x8a40d8, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x545ec74 | out: ppvObject=0x545ec74*=0x0) returned 0x80004002 [0244.537] WbemLocator:IUnknown:AddRef (This=0x89cd08) returned 0x3 [0244.537] WbemLocator:IUnknown:QueryInterface (in: This=0x89cd08, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e9dc | out: ppvObject=0x545e9dc*=0x0) returned 0x80004002 [0244.537] WbemLocator:IUnknown:QueryInterface (in: This=0x89cd08, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e98c | out: ppvObject=0x545e98c*=0x0) returned 0x80004002 [0244.537] WbemLocator:IUnknown:QueryInterface (in: This=0x89cd08, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e998 | out: ppvObject=0x545e998*=0x89cc64) returned 0x0 [0244.537] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89cc64, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e9a0 | out: pCid=0x545e9a0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0244.537] WbemLocator:IUnknown:Release (This=0x89cc64) returned 0x3 [0244.537] CoGetContextToken (in: pToken=0x545e9f8 | out: pToken=0x545e9f8) returned 0x0 [0244.537] CoGetContextToken (in: pToken=0x545ee00 | out: pToken=0x545ee00) returned 0x0 [0244.537] WbemLocator:IUnknown:QueryInterface (in: This=0x89cd08, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545ee90 | out: ppvObject=0x545ee90*=0x89ccec) returned 0x0 [0244.537] WbemLocator:IRpcOptions:Query (in: This=0x89ccec, pPrx=0x89cd08, dwProperty=2, pdwValue=0x545eeb8 | out: pdwValue=0x545eeb8) returned 0x80004002 [0244.537] WbemLocator:IUnknown:Release (This=0x89ccec) returned 0x3 [0244.537] WbemLocator:IUnknown:Release (This=0x89cd08) returned 0x2 [0244.537] CoGetContextToken (in: pToken=0x545f3d8 | out: pToken=0x545f3d8) returned 0x0 [0244.538] CoGetContextToken (in: pToken=0x545f338 | out: pToken=0x545f338) returned 0x0 [0244.538] WbemLocator:IUnknown:QueryInterface (in: This=0x89cd08, riid=0x545f408*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x545f404 | out: ppvObject=0x545f404*=0x8a40d8) returned 0x0 [0244.538] WbemLocator:IUnknown:AddRef (This=0x8a40d8) returned 0x4 [0244.538] WbemLocator:IUnknown:Release (This=0x8a40d8) returned 0x3 [0244.538] WbemLocator:IUnknown:Release (This=0x8a40d8) returned 0x2 [0244.538] SysStringLen (param_1=0x0) returned 0x0 [0244.538] CoUninitialize () Thread: id = 139 os_tid = 0x12b8 [0245.975] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.975] RoInitialize () returned 0x1 [0245.975] RoUninitialize () returned 0x0 [0245.976] CoGetClassObject (in: rclsid=0x88833c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6b2e54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x545f290 | out: ppv=0x545f290*=0x8c0048) returned 0x0 [0245.977] WbemLocator:IUnknown:QueryInterface (in: This=0x8c0048, riid=0x6b2995e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545f4a8 | out: ppvObject=0x545f4a8*=0x0) returned 0x80004002 [0245.977] WbemLocator:IClassFactory:CreateInstance (in: This=0x8c0048, pUnkOuter=0x0, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f4bc | out: ppvObject=0x545f4bc*=0x83c520) returned 0x0 [0245.977] WbemLocator:IUnknown:Release (This=0x8c0048) returned 0x0 [0245.977] WbemLocator:IUnknown:QueryInterface (in: This=0x83c520, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f0dc | out: ppvObject=0x545f0dc*=0x83c520) returned 0x0 [0245.977] WbemLocator:IUnknown:QueryInterface (in: This=0x83c520, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545f098 | out: ppvObject=0x545f098*=0x0) returned 0x80004002 [0245.977] WbemLocator:IUnknown:QueryInterface (in: This=0x83c520, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x545ec8c | out: ppvObject=0x545ec8c*=0x0) returned 0x80004002 [0245.977] WbemLocator:IUnknown:AddRef (This=0x83c520) returned 0x3 [0245.977] WbemLocator:IUnknown:QueryInterface (in: This=0x83c520, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e9f4 | out: ppvObject=0x545e9f4*=0x0) returned 0x80004002 [0245.977] WbemLocator:IUnknown:QueryInterface (in: This=0x83c520, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e9a4 | out: ppvObject=0x545e9a4*=0x0) returned 0x80004002 [0245.977] WbemLocator:IUnknown:QueryInterface (in: This=0x83c520, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e9b0 | out: ppvObject=0x545e9b0*=0x0) returned 0x80004002 [0245.977] CoGetContextToken (in: pToken=0x545ea10 | out: pToken=0x545ea10) returned 0x0 [0245.978] CoGetContextToken (in: pToken=0x545ee18 | out: pToken=0x545ee18) returned 0x0 [0245.978] WbemLocator:IUnknown:QueryInterface (in: This=0x83c520, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545eea8 | out: ppvObject=0x545eea8*=0x0) returned 0x80004002 [0245.978] WbemLocator:IUnknown:Release (This=0x83c520) returned 0x2 [0245.978] WbemLocator:IUnknown:Release (This=0x83c520) returned 0x1 [0245.978] CoGetContextToken (in: pToken=0x545f488 | out: pToken=0x545f488) returned 0x0 [0245.978] CoGetContextToken (in: pToken=0x545f3e8 | out: pToken=0x545f3e8) returned 0x0 [0245.978] WbemLocator:IUnknown:QueryInterface (in: This=0x83c520, riid=0x545f4b8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x545f4b4 | out: ppvObject=0x545f4b4*=0x83c520) returned 0x0 [0245.978] WbemLocator:IUnknown:AddRef (This=0x83c520) returned 0x3 [0245.978] WbemLocator:IUnknown:Release (This=0x83c520) returned 0x2 [0245.978] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x8069c8, puCount=0x545f64c | out: puCount=0x545f64c*=0x2) returned 0x0 [0245.978] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=8, puBuffLength=0x545f648*=0x0, pszText=0x0 | out: puBuffLength=0x545f648*=0xf, pszText=0x0) returned 0x0 [0245.978] WbemDefPath:IWbemPath:GetText (in: This=0x8069c8, lFlags=8, puBuffLength=0x545f648*=0xf, pszText="00000000000000" | out: puBuffLength=0x545f648*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0245.978] CoCreateInstance (in: rclsid=0x6c7e1284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6c7e12e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x545f524 | out: ppv=0x545f524*=0x83c440) returned 0x0 [0245.978] WbemLocator:IWbemLocator:ConnectServer (in: This=0x83c440, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x545f5b8 | out: ppNamespace=0x545f5b8*=0x8a3e08) returned 0x0 [0245.989] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3e08, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f454 | out: ppvObject=0x545f454*=0x89cde4) returned 0x0 [0245.989] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89cde4, pProxy=0x8a3e08, pAuthnSvc=0x545f4a4, pAuthzSvc=0x545f4a0, pServerPrincName=0x545f498, pAuthnLevel=0x545f49c, pImpLevel=0x545f48c, pAuthInfo=0x545f490, pCapabilites=0x545f494 | out: pAuthnSvc=0x545f4a4*=0xa, pAuthzSvc=0x545f4a0*=0x0, pServerPrincName=0x545f498, pAuthnLevel=0x545f49c*=0x6, pImpLevel=0x545f48c*=0x2, pAuthInfo=0x545f490, pCapabilites=0x545f494*=0x1) returned 0x0 [0245.989] WbemLocator:IUnknown:Release (This=0x89cde4) returned 0x1 [0245.989] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3e08, riid=0x6c7e10f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f448 | out: ppvObject=0x545f448*=0x89ce08) returned 0x0 [0245.989] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3e08, riid=0x6c7e1104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f444 | out: ppvObject=0x545f444*=0x89cde4) returned 0x0 [0245.989] WbemLocator:IClientSecurity:SetBlanket (This=0x89cde4, pProxy=0x8a3e08, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0245.989] WbemLocator:IUnknown:Release (This=0x89cde4) returned 0x2 [0245.989] WbemLocator:IUnknown:Release (This=0x89ce08) returned 0x1 [0245.989] CoTaskMemFree (pv=0x888210) [0245.989] WbemLocator:IUnknown:Release (This=0x83c440) returned 0x0 [0245.989] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3e08, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545f044 | out: ppvObject=0x545f044*=0x89ce08) returned 0x0 [0245.989] WbemLocator:IUnknown:QueryInterface (in: This=0x89ce08, riid=0x6b36fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x545f000 | out: ppvObject=0x545f000*=0x0) returned 0x80004002 [0245.990] WbemLocator:IUnknown:QueryInterface (in: This=0x89ce08, riid=0x6b36fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x545ee1c | out: ppvObject=0x545ee1c*=0x0) returned 0x80004002 [0245.990] WbemLocator:IUnknown:QueryInterface (in: This=0x8a3e08, riid=0x6b37056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x545ebf4 | out: ppvObject=0x545ebf4*=0x0) returned 0x80004002 [0245.991] WbemLocator:IUnknown:AddRef (This=0x89ce08) returned 0x3 [0245.991] WbemLocator:IUnknown:QueryInterface (in: This=0x89ce08, riid=0x6b370208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x545e95c | out: ppvObject=0x545e95c*=0x0) returned 0x80004002 [0245.991] WbemLocator:IUnknown:QueryInterface (in: This=0x89ce08, riid=0x6b37015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x545e90c | out: ppvObject=0x545e90c*=0x0) returned 0x80004002 [0245.991] WbemLocator:IUnknown:QueryInterface (in: This=0x89ce08, riid=0x6b2440e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545e918 | out: ppvObject=0x545e918*=0x89cd64) returned 0x0 [0245.991] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x89cd64, riid=0x6b236c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x545e920 | out: pCid=0x545e920*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0245.991] WbemLocator:IUnknown:Release (This=0x89cd64) returned 0x3 [0245.991] CoGetContextToken (in: pToken=0x545e978 | out: pToken=0x545e978) returned 0x0 [0245.991] CoGetContextToken (in: pToken=0x545ed80 | out: pToken=0x545ed80) returned 0x0 [0245.991] WbemLocator:IUnknown:QueryInterface (in: This=0x89ce08, riid=0x6b370448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x545ee10 | out: ppvObject=0x545ee10*=0x89cdec) returned 0x0 [0245.991] WbemLocator:IRpcOptions:Query (in: This=0x89cdec, pPrx=0x89ce08, dwProperty=2, pdwValue=0x545ee38 | out: pdwValue=0x545ee38) returned 0x80004002 [0245.991] WbemLocator:IUnknown:Release (This=0x89cdec) returned 0x3 [0245.991] WbemLocator:IUnknown:Release (This=0x89ce08) returned 0x2 [0245.991] CoGetContextToken (in: pToken=0x545f358 | out: pToken=0x545f358) returned 0x0 [0245.991] CoGetContextToken (in: pToken=0x545f2b8 | out: pToken=0x545f2b8) returned 0x0 [0245.991] WbemLocator:IUnknown:QueryInterface (in: This=0x89ce08, riid=0x545f388*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x545f384 | out: ppvObject=0x545f384*=0x8a3e08) returned 0x0 [0245.991] WbemLocator:IUnknown:AddRef (This=0x8a3e08) returned 0x4 [0245.991] WbemLocator:IUnknown:Release (This=0x8a3e08) returned 0x3 [0245.991] WbemLocator:IUnknown:Release (This=0x8a3e08) returned 0x2 [0245.992] SysStringLen (param_1=0x0) returned 0x0 [0245.992] CoUninitialize () Thread: id = 141 os_tid = 0x12c4 Thread: id = 142 os_tid = 0xba8 [0250.417] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0250.418] RoInitialize () returned 0x1 [0250.418] RoUninitialize () returned 0x0 [0250.419] ResetEvent (hEvent=0x230) returned 1 Thread: id = 143 os_tid = 0xef8 Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7534a000" os_pid = "0x364" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ac37" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 816 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 817 start_va = 0x20000 end_va = 0x21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 818 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 819 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 820 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 821 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 822 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 823 start_va = 0x100000 end_va = 0x100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll") Region: id = 824 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 825 start_va = 0x130000 end_va = 0x130fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usocore.dll.mui" filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui") Region: id = 826 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 827 start_va = 0x150000 end_va = 0x151fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 828 start_va = 0x160000 end_va = 0x161fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 829 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 830 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 831 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 832 start_va = 0x1b0000 end_va = 0x1b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 833 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 834 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 835 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 836 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 837 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 838 start_va = 0x500000 end_va = 0x5bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 839 start_va = 0x5c0000 end_va = 0x747fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 840 start_va = 0x750000 end_va = 0x750fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 841 start_va = 0x760000 end_va = 0x760fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 842 start_va = 0x770000 end_va = 0x773fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 843 start_va = 0x780000 end_va = 0x783fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 844 start_va = 0x790000 end_va = 0x796fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 845 start_va = 0x7a0000 end_va = 0x7e4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 846 start_va = 0x800000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 847 start_va = 0x900000 end_va = 0xa80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 848 start_va = 0xa90000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 849 start_va = 0xb50000 end_va = 0xf4afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 850 start_va = 0xf50000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 851 start_va = 0x10b0000 end_va = 0x10b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010b0000" filename = "" Region: id = 852 start_va = 0x10d0000 end_va = 0x10d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010d0000" filename = "" Region: id = 853 start_va = 0x1100000 end_va = 0x1106fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 854 start_va = 0x1110000 end_va = 0x118ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 855 start_va = 0x1190000 end_va = 0x11defff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001190000" filename = "" Region: id = 856 start_va = 0x1200000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 857 start_va = 0x1300000 end_va = 0x137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 858 start_va = 0x1380000 end_va = 0x13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001380000" filename = "" Region: id = 859 start_va = 0x1400000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 860 start_va = 0x1500000 end_va = 0x15fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 861 start_va = 0x1600000 end_va = 0x1936fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 862 start_va = 0x1940000 end_va = 0x1a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 863 start_va = 0x1a40000 end_va = 0x1b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a40000" filename = "" Region: id = 864 start_va = 0x1b40000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b40000" filename = "" Region: id = 865 start_va = 0x1c40000 end_va = 0x1ccdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 866 start_va = 0x1d10000 end_va = 0x1d16fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 867 start_va = 0x1d40000 end_va = 0x1e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 868 start_va = 0x1e40000 end_va = 0x1f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 869 start_va = 0x1f40000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 870 start_va = 0x2040000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 871 start_va = 0x20f0000 end_va = 0x20f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 872 start_va = 0x2100000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 873 start_va = 0x2200000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 874 start_va = 0x2300000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 875 start_va = 0x2400000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 876 start_va = 0x2500000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 877 start_va = 0x2600000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 878 start_va = 0x2700000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 879 start_va = 0x2800000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 880 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 881 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 882 start_va = 0x2b00000 end_va = 0x2bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 883 start_va = 0x2c00000 end_va = 0x2cdffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 884 start_va = 0x2ce0000 end_va = 0x2ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ce0000" filename = "" Region: id = 885 start_va = 0x2ee0000 end_va = 0x2fdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 886 start_va = 0x3000000 end_va = 0x30fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 887 start_va = 0x3100000 end_va = 0x317ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 888 start_va = 0x3180000 end_va = 0x31fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 889 start_va = 0x3200000 end_va = 0x3206fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003200000" filename = "" Region: id = 890 start_va = 0x3210000 end_va = 0x330ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 891 start_va = 0x3310000 end_va = 0x340ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003310000" filename = "" Region: id = 892 start_va = 0x3610000 end_va = 0x370ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003610000" filename = "" Region: id = 893 start_va = 0x3a00000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 894 start_va = 0x3b00000 end_va = 0x3bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 895 start_va = 0x3c00000 end_va = 0x3cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 896 start_va = 0x3d00000 end_va = 0x3dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d00000" filename = "" Region: id = 897 start_va = 0x3e00000 end_va = 0x3efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 898 start_va = 0x3f00000 end_va = 0x3ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 899 start_va = 0x4000000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 900 start_va = 0x4100000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 901 start_va = 0x4240000 end_va = 0x4246fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004240000" filename = "" Region: id = 902 start_va = 0x4250000 end_va = 0x42cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004250000" filename = "" Region: id = 903 start_va = 0x4300000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 904 start_va = 0x4400000 end_va = 0x44fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 905 start_va = 0x4500000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 906 start_va = 0x4600000 end_va = 0x46fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 907 start_va = 0x4700000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 908 start_va = 0x4800000 end_va = 0x48fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 909 start_va = 0x4900000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004900000" filename = "" Region: id = 910 start_va = 0x4a00000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 911 start_va = 0x4b00000 end_va = 0x4bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 912 start_va = 0x4c00000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 913 start_va = 0x4d00000 end_va = 0x4d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 914 start_va = 0x4d80000 end_va = 0x4d80fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 915 start_va = 0x4e90000 end_va = 0x4e91fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 916 start_va = 0x4eb0000 end_va = 0x4eb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004eb0000" filename = "" Region: id = 917 start_va = 0x4ec0000 end_va = 0x4ec4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 918 start_va = 0x4ed0000 end_va = 0x4ed6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ed0000" filename = "" Region: id = 919 start_va = 0x4ee0000 end_va = 0x4eeffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 920 start_va = 0x4f00000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 921 start_va = 0x5100000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 922 start_va = 0x5200000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 923 start_va = 0x5300000 end_va = 0x53fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005300000" filename = "" Region: id = 924 start_va = 0x5400000 end_va = 0x54fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005400000" filename = "" Region: id = 925 start_va = 0x5500000 end_va = 0x55fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005500000" filename = "" Region: id = 926 start_va = 0x5620000 end_va = 0x5630fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1256.nls" filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls") Region: id = 927 start_va = 0x5640000 end_va = 0x5650fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 928 start_va = 0x5660000 end_va = 0x5670fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1254.nls" filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls") Region: id = 929 start_va = 0x5680000 end_va = 0x5690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 930 start_va = 0x56a0000 end_va = 0x56b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1253.nls" filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls") Region: id = 931 start_va = 0x56c0000 end_va = 0x56d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1257.nls" filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls") Region: id = 932 start_va = 0x56f0000 end_va = 0x56f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056f0000" filename = "" Region: id = 933 start_va = 0x5700000 end_va = 0x57fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 934 start_va = 0x5800000 end_va = 0x58fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005800000" filename = "" Region: id = 935 start_va = 0x5900000 end_va = 0x59fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 936 start_va = 0x5a00000 end_va = 0x5a10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 937 start_va = 0x5a20000 end_va = 0x5a30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_874.nls" filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls") Region: id = 938 start_va = 0x5a50000 end_va = 0x5acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a50000" filename = "" Region: id = 939 start_va = 0x5ad0000 end_va = 0x5b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ad0000" filename = "" Region: id = 940 start_va = 0x5b50000 end_va = 0x5bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 941 start_va = 0x5bd0000 end_va = 0x5bd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005bd0000" filename = "" Region: id = 942 start_va = 0x5be0000 end_va = 0x5bf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1258.nls" filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls") Region: id = 943 start_va = 0x5c10000 end_va = 0x5c37fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_932.nls" filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls") Region: id = 944 start_va = 0x5c40000 end_va = 0x5c70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_949.nls" filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls") Region: id = 945 start_va = 0x5c80000 end_va = 0x5cb0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 946 start_va = 0x5cc0000 end_va = 0x5cf0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_950.nls" filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls") Region: id = 947 start_va = 0x5d10000 end_va = 0x5e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d10000" filename = "" Region: id = 948 start_va = 0x5e10000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e10000" filename = "" Region: id = 949 start_va = 0x5f10000 end_va = 0x5f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 950 start_va = 0x5f90000 end_va = 0x608ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f90000" filename = "" Region: id = 951 start_va = 0x6110000 end_va = 0x620ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006110000" filename = "" Region: id = 952 start_va = 0x6310000 end_va = 0x640ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006310000" filename = "" Region: id = 953 start_va = 0x6410000 end_va = 0x650ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006410000" filename = "" Region: id = 954 start_va = 0x6510000 end_va = 0x660ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006510000" filename = "" Region: id = 955 start_va = 0x6610000 end_va = 0x670ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006610000" filename = "" Region: id = 956 start_va = 0x6710000 end_va = 0x680ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006710000" filename = "" Region: id = 957 start_va = 0x6900000 end_va = 0x69fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006900000" filename = "" Region: id = 958 start_va = 0x6a00000 end_va = 0x6afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a00000" filename = "" Region: id = 959 start_va = 0x6b00000 end_va = 0x6bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b00000" filename = "" Region: id = 960 start_va = 0x6c00000 end_va = 0x6cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 961 start_va = 0x6d00000 end_va = 0x6dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 962 start_va = 0x6e00000 end_va = 0x6efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e00000" filename = "" Region: id = 963 start_va = 0x6f00000 end_va = 0x6ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 964 start_va = 0x7000000 end_va = 0x70fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 965 start_va = 0x7200000 end_va = 0x72fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 966 start_va = 0x7400000 end_va = 0x74fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007400000" filename = "" Region: id = 967 start_va = 0x7500000 end_va = 0x75fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007500000" filename = "" Region: id = 968 start_va = 0x7720000 end_va = 0x781ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007720000" filename = "" Region: id = 969 start_va = 0x7b20000 end_va = 0x7c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007b20000" filename = "" Region: id = 970 start_va = 0x7d20000 end_va = 0x7e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 971 start_va = 0x7e20000 end_va = 0x7f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e20000" filename = "" Region: id = 972 start_va = 0x7f20000 end_va = 0x801ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f20000" filename = "" Region: id = 973 start_va = 0x8220000 end_va = 0x831ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008220000" filename = "" Region: id = 974 start_va = 0x8320000 end_va = 0x841ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008320000" filename = "" Region: id = 975 start_va = 0x8b20000 end_va = 0x8c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008b20000" filename = "" Region: id = 976 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 977 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 978 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 979 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 980 start_va = 0x7ff73cbd0000 end_va = 0x7ff73cbdcfff monitored = 0 entry_point = 0x7ff73cbd3980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 981 start_va = 0x7ffd8eab0000 end_va = 0x7ffd8eb0cfff monitored = 0 entry_point = 0x7ffd8eade510 region_type = mapped_file name = "usocore.dll" filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll") Region: id = 982 start_va = 0x7ffd8fd80000 end_va = 0x7ffd9002ffff monitored = 0 entry_point = 0x7ffd8fd81cf0 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 983 start_va = 0x7ffd92570000 end_va = 0x7ffd925a1fff monitored = 0 entry_point = 0x7ffd9257b0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 984 start_va = 0x7ffd96d00000 end_va = 0x7ffd96d13fff monitored = 0 entry_point = 0x7ffd96d03710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 985 start_va = 0x7ffd96d20000 end_va = 0x7ffd96d47fff monitored = 0 entry_point = 0x7ffd96d2efc0 region_type = mapped_file name = "dssenh.dll" filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll") Region: id = 986 start_va = 0x7ffd96db0000 end_va = 0x7ffd96dcdfff monitored = 0 entry_point = 0x7ffd96dbef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 987 start_va = 0x7ffd96dd0000 end_va = 0x7ffd96e4ffff monitored = 0 entry_point = 0x7ffd96dfd280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 988 start_va = 0x7ffd96e50000 end_va = 0x7ffd96e85fff monitored = 0 entry_point = 0x7ffd96e527f0 region_type = mapped_file name = "windows.networking.hostname.dll" filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll") Region: id = 989 start_va = 0x7ffd96ef0000 end_va = 0x7ffd96f05fff monitored = 0 entry_point = 0x7ffd96ef1d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 990 start_va = 0x7ffd96fc0000 end_va = 0x7ffd96fd0fff monitored = 0 entry_point = 0x7ffd96fc7480 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 991 start_va = 0x7ffd96fe0000 end_va = 0x7ffd97063fff monitored = 0 entry_point = 0x7ffd96ff8d50 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 992 start_va = 0x7ffd97150000 end_va = 0x7ffd97165fff monitored = 0 entry_point = 0x7ffd971555e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 993 start_va = 0x7ffd97170000 end_va = 0x7ffd97245fff monitored = 0 entry_point = 0x7ffd9719a800 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 994 start_va = 0x7ffd97250000 end_va = 0x7ffd972b3fff monitored = 0 entry_point = 0x7ffd9726bed0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 995 start_va = 0x7ffd972c0000 end_va = 0x7ffd972e4fff monitored = 0 entry_point = 0x7ffd972c9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 996 start_va = 0x7ffd972f0000 end_va = 0x7ffd97303fff monitored = 0 entry_point = 0x7ffd972f1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 997 start_va = 0x7ffd97310000 end_va = 0x7ffd97325fff monitored = 0 entry_point = 0x7ffd97311af0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 998 start_va = 0x7ffd97330000 end_va = 0x7ffd97349fff monitored = 0 entry_point = 0x7ffd97332330 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 999 start_va = 0x7ffd97350000 end_va = 0x7ffd97445fff monitored = 0 entry_point = 0x7ffd97389590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1000 start_va = 0x7ffd97450000 end_va = 0x7ffd974c3fff monitored = 0 entry_point = 0x7ffd97465eb0 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1001 start_va = 0x7ffd974d0000 end_va = 0x7ffd97606fff monitored = 0 entry_point = 0x7ffd97510480 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1002 start_va = 0x7ffd97630000 end_va = 0x7ffd97640fff monitored = 0 entry_point = 0x7ffd97632fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1003 start_va = 0x7ffd97650000 end_va = 0x7ffd9766dfff monitored = 0 entry_point = 0x7ffd97653a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1004 start_va = 0x7ffd97670000 end_va = 0x7ffd976f1fff monitored = 0 entry_point = 0x7ffd97672a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1005 start_va = 0x7ffd98150000 end_va = 0x7ffd9815efff monitored = 0 entry_point = 0x7ffd98154960 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1006 start_va = 0x7ffd98160000 end_va = 0x7ffd981a5fff monitored = 0 entry_point = 0x7ffd981679a0 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 1007 start_va = 0x7ffd981b0000 end_va = 0x7ffd981effff monitored = 0 entry_point = 0x7ffd981bcbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 1008 start_va = 0x7ffd981f0000 end_va = 0x7ffd98236fff monitored = 0 entry_point = 0x7ffd981f1d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 1009 start_va = 0x7ffd98290000 end_va = 0x7ffd9829cfff monitored = 0 entry_point = 0x7ffd98291420 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 1010 start_va = 0x7ffd984f0000 end_va = 0x7ffd98531fff monitored = 0 entry_point = 0x7ffd984f3670 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1011 start_va = 0x7ffd985b0000 end_va = 0x7ffd985cefff monitored = 0 entry_point = 0x7ffd985b37e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 1012 start_va = 0x7ffd985d0000 end_va = 0x7ffd98648fff monitored = 0 entry_point = 0x7ffd985d76a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 1013 start_va = 0x7ffd98830000 end_va = 0x7ffd98847fff monitored = 0 entry_point = 0x7ffd98832000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1014 start_va = 0x7ffd98850000 end_va = 0x7ffd989d1fff monitored = 0 entry_point = 0x7ffd988682a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1015 start_va = 0x7ffd989e0000 end_va = 0x7ffd989f7fff monitored = 0 entry_point = 0x7ffd989e4e10 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 1016 start_va = 0x7ffd98a00000 end_va = 0x7ffd98a24fff monitored = 0 entry_point = 0x7ffd98a05ca0 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 1017 start_va = 0x7ffd98b40000 end_va = 0x7ffd98be2fff monitored = 0 entry_point = 0x7ffd98b42c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1018 start_va = 0x7ffd98bf0000 end_va = 0x7ffd98c41fff monitored = 0 entry_point = 0x7ffd98bf5770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1019 start_va = 0x7ffd98c50000 end_va = 0x7ffd98c7dfff monitored = 1 entry_point = 0x7ffd98c52300 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 1020 start_va = 0x7ffd98c80000 end_va = 0x7ffd98cddfff monitored = 0 entry_point = 0x7ffd98c85080 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 1021 start_va = 0x7ffd98ce0000 end_va = 0x7ffd98cfffff monitored = 0 entry_point = 0x7ffd98ce1f50 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 1022 start_va = 0x7ffd98d00000 end_va = 0x7ffd98d08fff monitored = 0 entry_point = 0x7ffd98d018f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 1023 start_va = 0x7ffd98d10000 end_va = 0x7ffd98d20fff monitored = 0 entry_point = 0x7ffd98d11d30 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1024 start_va = 0x7ffd98d30000 end_va = 0x7ffd98d70fff monitored = 0 entry_point = 0x7ffd98d33750 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1025 start_va = 0x7ffd98d80000 end_va = 0x7ffd98e72fff monitored = 0 entry_point = 0x7ffd98da5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1026 start_va = 0x7ffd9b190000 end_va = 0x7ffd9b1dbfff monitored = 0 entry_point = 0x7ffd9b1a5310 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1027 start_va = 0x7ffd9b2a0000 end_va = 0x7ffd9b2a9fff monitored = 0 entry_point = 0x7ffd9b2a1350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1028 start_va = 0x7ffd9b340000 end_va = 0x7ffd9b3befff monitored = 0 entry_point = 0x7ffd9b357110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1029 start_va = 0x7ffd9b3c0000 end_va = 0x7ffd9b3fbfff monitored = 0 entry_point = 0x7ffd9b3c6aa0 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1030 start_va = 0x7ffd9b400000 end_va = 0x7ffd9b40bfff monitored = 0 entry_point = 0x7ffd9b4035c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1031 start_va = 0x7ffd9ca20000 end_va = 0x7ffd9ca28fff monitored = 0 entry_point = 0x7ffd9ca221d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 1032 start_va = 0x7ffd9ca30000 end_va = 0x7ffd9ca64fff monitored = 0 entry_point = 0x7ffd9ca3a270 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 1033 start_va = 0x7ffd9cb70000 end_va = 0x7ffd9cde9fff monitored = 0 entry_point = 0x7ffd9cb8a7a0 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 1034 start_va = 0x7ffd9d000000 end_va = 0x7ffd9d00ffff monitored = 0 entry_point = 0x7ffd9d001690 region_type = mapped_file name = "wups.dll" filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll") Region: id = 1035 start_va = 0x7ffd9da20000 end_va = 0x7ffd9da41fff monitored = 0 entry_point = 0x7ffd9da32540 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 1036 start_va = 0x7ffd9da50000 end_va = 0x7ffd9db24fff monitored = 0 entry_point = 0x7ffd9da6cf80 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 1037 start_va = 0x7ffd9e610000 end_va = 0x7ffd9e61ffff monitored = 0 entry_point = 0x7ffd9e611700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 1038 start_va = 0x7ffd9e620000 end_va = 0x7ffd9e628fff monitored = 0 entry_point = 0x7ffd9e621ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 1039 start_va = 0x7ffd9e630000 end_va = 0x7ffd9e65cfff monitored = 0 entry_point = 0x7ffd9e632290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 1040 start_va = 0x7ffd9e660000 end_va = 0x7ffd9e6b1fff monitored = 0 entry_point = 0x7ffd9e6638e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 1041 start_va = 0x7ffd9ece0000 end_va = 0x7ffd9ece9fff monitored = 0 entry_point = 0x7ffd9ece14c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1042 start_va = 0x7ffd9f020000 end_va = 0x7ffd9f031fff monitored = 0 entry_point = 0x7ffd9f023580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1043 start_va = 0x7ffd9f0b0000 end_va = 0x7ffd9f0cafff monitored = 0 entry_point = 0x7ffd9f0b1040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 1044 start_va = 0x7ffd9f1b0000 end_va = 0x7ffd9f1c4fff monitored = 0 entry_point = 0x7ffd9f1b2dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 1045 start_va = 0x7ffd9f1d0000 end_va = 0x7ffd9f1e2fff monitored = 0 entry_point = 0x7ffd9f1d1b10 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 1046 start_va = 0x7ffd9f1f0000 end_va = 0x7ffd9f28ffff monitored = 0 entry_point = 0x7ffd9f260910 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1047 start_va = 0x7ffd9f290000 end_va = 0x7ffd9f2b5fff monitored = 0 entry_point = 0x7ffd9f2a9020 region_type = mapped_file name = "devicemetadataretrievalclient.dll" filename = "\\Windows\\System32\\DeviceMetadataRetrievalClient.dll" (normalized: "c:\\windows\\system32\\devicemetadataretrievalclient.dll") Region: id = 1048 start_va = 0x7ffd9f2e0000 end_va = 0x7ffd9f3eefff monitored = 0 entry_point = 0x7ffd9f31c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1049 start_va = 0x7ffd9f3f0000 end_va = 0x7ffd9f42efff monitored = 0 entry_point = 0x7ffd9f4182d0 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 1050 start_va = 0x7ffd9f480000 end_va = 0x7ffd9f4e6fff monitored = 0 entry_point = 0x7ffd9f48b160 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1051 start_va = 0x7ffd9f4f0000 end_va = 0x7ffd9f503fff monitored = 0 entry_point = 0x7ffd9f4f2a00 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1052 start_va = 0x7ffd9f510000 end_va = 0x7ffd9f520fff monitored = 0 entry_point = 0x7ffd9f5128d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 1053 start_va = 0x7ffd9f530000 end_va = 0x7ffd9f573fff monitored = 0 entry_point = 0x7ffd9f5583e0 region_type = mapped_file name = "updatehandlers.dll" filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll") Region: id = 1054 start_va = 0x7ffd9f580000 end_va = 0x7ffd9f59cfff monitored = 0 entry_point = 0x7ffd9f584f60 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 1055 start_va = 0x7ffd9f5a0000 end_va = 0x7ffd9f5b7fff monitored = 0 entry_point = 0x7ffd9f5ab850 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 1056 start_va = 0x7ffd9fcd0000 end_va = 0x7ffd9fdecfff monitored = 0 entry_point = 0x7ffd9fcffe60 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1057 start_va = 0x7ffda0120000 end_va = 0x7ffda012cfff monitored = 0 entry_point = 0x7ffda0125020 region_type = mapped_file name = "devicedriverretrievalclient.dll" filename = "\\Windows\\System32\\DeviceDriverRetrievalClient.dll" (normalized: "c:\\windows\\system32\\devicedriverretrievalclient.dll") Region: id = 1058 start_va = 0x7ffda0130000 end_va = 0x7ffda0153fff monitored = 0 entry_point = 0x7ffda0146390 region_type = mapped_file name = "devpropmgr.dll" filename = "\\Windows\\System32\\DevPropMgr.dll" (normalized: "c:\\windows\\system32\\devpropmgr.dll") Region: id = 1059 start_va = 0x7ffda0160000 end_va = 0x7ffda01f9fff monitored = 0 entry_point = 0x7ffda017ada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1060 start_va = 0x7ffda02f0000 end_va = 0x7ffda02fdfff monitored = 0 entry_point = 0x7ffda02f1460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1061 start_va = 0x7ffda0310000 end_va = 0x7ffda0376fff monitored = 0 entry_point = 0x7ffda03163e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1062 start_va = 0x7ffda0530000 end_va = 0x7ffda05effff monitored = 0 entry_point = 0x7ffda055fd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1063 start_va = 0x7ffda07a0000 end_va = 0x7ffda084dfff monitored = 0 entry_point = 0x7ffda07b80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 1064 start_va = 0x7ffda0850000 end_va = 0x7ffda0861fff monitored = 0 entry_point = 0x7ffda0859260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 1065 start_va = 0x7ffda0870000 end_va = 0x7ffda0920fff monitored = 0 entry_point = 0x7ffda08e88b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 1066 start_va = 0x7ffda0930000 end_va = 0x7ffda0954fff monitored = 0 entry_point = 0x7ffda0942f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 1067 start_va = 0x7ffda0960000 end_va = 0x7ffda0970fff monitored = 0 entry_point = 0x7ffda0967ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 1068 start_va = 0x7ffda0980000 end_va = 0x7ffda0999fff monitored = 0 entry_point = 0x7ffda0982cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 1069 start_va = 0x7ffda09a0000 end_va = 0x7ffda09abfff monitored = 0 entry_point = 0x7ffda09a14d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 1070 start_va = 0x7ffda09b0000 end_va = 0x7ffda09c4fff monitored = 0 entry_point = 0x7ffda09b3460 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1071 start_va = 0x7ffda0aa0000 end_va = 0x7ffda0af4fff monitored = 0 entry_point = 0x7ffda0aa3fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 1072 start_va = 0x7ffda0b00000 end_va = 0x7ffda0b36fff monitored = 0 entry_point = 0x7ffda0b06020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 1073 start_va = 0x7ffda0b40000 end_va = 0x7ffda0b5ffff monitored = 0 entry_point = 0x7ffda0b439a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 1074 start_va = 0x7ffda0b60000 end_va = 0x7ffda0ba0fff monitored = 0 entry_point = 0x7ffda0b64840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 1075 start_va = 0x7ffda0bb0000 end_va = 0x7ffda0bb7fff monitored = 0 entry_point = 0x7ffda0bb13b0 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 1076 start_va = 0x7ffda0bc0000 end_va = 0x7ffda0bd6fff monitored = 0 entry_point = 0x7ffda0bc7520 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 1077 start_va = 0x7ffda0d10000 end_va = 0x7ffda0d23fff monitored = 0 entry_point = 0x7ffda0d12d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1078 start_va = 0x7ffda0dc0000 end_va = 0x7ffda0dd1fff monitored = 0 entry_point = 0x7ffda0dc1a80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 1079 start_va = 0x7ffda0de0000 end_va = 0x7ffda0df7fff monitored = 0 entry_point = 0x7ffda0de1b10 region_type = mapped_file name = "locationframeworkinternalps.dll" filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll") Region: id = 1080 start_va = 0x7ffda1010000 end_va = 0x7ffda10a2fff monitored = 0 entry_point = 0x7ffda1019680 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 1081 start_va = 0x7ffda11c0000 end_va = 0x7ffda11d8fff monitored = 0 entry_point = 0x7ffda11c4520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1082 start_va = 0x7ffda1290000 end_va = 0x7ffda1357fff monitored = 0 entry_point = 0x7ffda12d13f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1083 start_va = 0x7ffda1360000 end_va = 0x7ffda13c0fff monitored = 0 entry_point = 0x7ffda1364b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1084 start_va = 0x7ffda13d0000 end_va = 0x7ffda154bfff monitored = 0 entry_point = 0x7ffda1421650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 1085 start_va = 0x7ffda1550000 end_va = 0x7ffda155afff monitored = 0 entry_point = 0x7ffda1551770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 1086 start_va = 0x7ffda1560000 end_va = 0x7ffda158dfff monitored = 0 entry_point = 0x7ffda1567550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1087 start_va = 0x7ffda1590000 end_va = 0x7ffda15a6fff monitored = 0 entry_point = 0x7ffda1595630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1088 start_va = 0x7ffda1790000 end_va = 0x7ffda17a9fff monitored = 0 entry_point = 0x7ffda1792430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1089 start_va = 0x7ffda17b0000 end_va = 0x7ffda17c5fff monitored = 0 entry_point = 0x7ffda17b19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1090 start_va = 0x7ffda17d0000 end_va = 0x7ffda1807fff monitored = 0 entry_point = 0x7ffda17e8cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1091 start_va = 0x7ffda1810000 end_va = 0x7ffda181afff monitored = 0 entry_point = 0x7ffda1811d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1092 start_va = 0x7ffda1820000 end_va = 0x7ffda182cfff monitored = 0 entry_point = 0x7ffda1822ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 1093 start_va = 0x7ffda1830000 end_va = 0x7ffda185efff monitored = 0 entry_point = 0x7ffda1838910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 1094 start_va = 0x7ffda18b0000 end_va = 0x7ffda18c5fff monitored = 0 entry_point = 0x7ffda18b1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1095 start_va = 0x7ffda1930000 end_va = 0x7ffda1a15fff monitored = 0 entry_point = 0x7ffda194cf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 1096 start_va = 0x7ffda1a20000 end_va = 0x7ffda1a99fff monitored = 0 entry_point = 0x7ffda1a47630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1097 start_va = 0x7ffda1aa0000 end_va = 0x7ffda1abefff monitored = 0 entry_point = 0x7ffda1aa4960 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 1098 start_va = 0x7ffda1cd0000 end_va = 0x7ffda1d3dfff monitored = 0 entry_point = 0x7ffda1cd7f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1099 start_va = 0x7ffda1d80000 end_va = 0x7ffda1e11fff monitored = 0 entry_point = 0x7ffda1dca780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 1100 start_va = 0x7ffda1ea0000 end_va = 0x7ffda1eb0fff monitored = 0 entry_point = 0x7ffda1ea3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1101 start_va = 0x7ffda22b0000 end_va = 0x7ffda22f0fff monitored = 0 entry_point = 0x7ffda22c7eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1102 start_va = 0x7ffda2300000 end_va = 0x7ffda23fbfff monitored = 0 entry_point = 0x7ffda2336df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1103 start_va = 0x7ffda25e0000 end_va = 0x7ffda2961fff monitored = 0 entry_point = 0x7ffda2631220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1104 start_va = 0x7ffda2970000 end_va = 0x7ffda2aa5fff monitored = 0 entry_point = 0x7ffda299f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1105 start_va = 0x7ffda3ba0000 end_va = 0x7ffda3cadfff monitored = 0 entry_point = 0x7ffda3beeaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 1106 start_va = 0x7ffda3fb0000 end_va = 0x7ffda3fbffff monitored = 0 entry_point = 0x7ffda3fb2c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 1107 start_va = 0x7ffda3fc0000 end_va = 0x7ffda3fd2fff monitored = 0 entry_point = 0x7ffda3fc57f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1108 start_va = 0x7ffda3fe0000 end_va = 0x7ffda401dfff monitored = 0 entry_point = 0x7ffda3fea050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1109 start_va = 0x7ffda4020000 end_va = 0x7ffda4046fff monitored = 0 entry_point = 0x7ffda4023bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 1110 start_va = 0x7ffda4050000 end_va = 0x7ffda405bfff monitored = 0 entry_point = 0x7ffda4052830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 1111 start_va = 0x7ffda4060000 end_va = 0x7ffda40b4fff monitored = 0 entry_point = 0x7ffda406fc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1112 start_va = 0x7ffda40c0000 end_va = 0x7ffda4123fff monitored = 0 entry_point = 0x7ffda40d5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1113 start_va = 0x7ffda42f0000 end_va = 0x7ffda43aefff monitored = 0 entry_point = 0x7ffda4311c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1114 start_va = 0x7ffda43b0000 end_va = 0x7ffda43effff monitored = 0 entry_point = 0x7ffda43c6c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1115 start_va = 0x7ffda43f0000 end_va = 0x7ffda4418fff monitored = 0 entry_point = 0x7ffda43fca00 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1116 start_va = 0x7ffda4420000 end_va = 0x7ffda4455fff monitored = 0 entry_point = 0x7ffda4430070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1117 start_va = 0x7ffda4ce0000 end_va = 0x7ffda4ceafff monitored = 0 entry_point = 0x7ffda4ce1de0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1118 start_va = 0x7ffda4d20000 end_va = 0x7ffda4d29fff monitored = 0 entry_point = 0x7ffda4d21660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1119 start_va = 0x7ffda4d30000 end_va = 0x7ffda4d47fff monitored = 0 entry_point = 0x7ffda4d35910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1120 start_va = 0x7ffda4d50000 end_va = 0x7ffda4e9cfff monitored = 0 entry_point = 0x7ffda4d93da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1121 start_va = 0x7ffda5930000 end_va = 0x7ffda59a8fff monitored = 0 entry_point = 0x7ffda594fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1122 start_va = 0x7ffda5b60000 end_va = 0x7ffda5ff2fff monitored = 0 entry_point = 0x7ffda5b6f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1123 start_va = 0x7ffda6000000 end_va = 0x7ffda6066fff monitored = 0 entry_point = 0x7ffda601e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 1124 start_va = 0x7ffda60c0000 end_va = 0x7ffda60c7fff monitored = 0 entry_point = 0x7ffda60c13e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 1125 start_va = 0x7ffda6100000 end_va = 0x7ffda6285fff monitored = 0 entry_point = 0x7ffda614d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1126 start_va = 0x7ffda6290000 end_va = 0x7ffda62abfff monitored = 0 entry_point = 0x7ffda62937a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1127 start_va = 0x7ffda62f0000 end_va = 0x7ffda6302fff monitored = 0 entry_point = 0x7ffda62f2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1128 start_va = 0x7ffda6460000 end_va = 0x7ffda649ffff monitored = 0 entry_point = 0x7ffda6471960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 1129 start_va = 0x7ffda65d0000 end_va = 0x7ffda65f6fff monitored = 0 entry_point = 0x7ffda65d7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1130 start_va = 0x7ffda6620000 end_va = 0x7ffda66c9fff monitored = 0 entry_point = 0x7ffda6647910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1131 start_va = 0x7ffda66d0000 end_va = 0x7ffda67cffff monitored = 0 entry_point = 0x7ffda6710f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1132 start_va = 0x7ffda6860000 end_va = 0x7ffda686bfff monitored = 0 entry_point = 0x7ffda6862480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1133 start_va = 0x7ffda6a30000 end_va = 0x7ffda6a61fff monitored = 0 entry_point = 0x7ffda6a42340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1134 start_va = 0x7ffda6ba0000 end_va = 0x7ffda6babfff monitored = 0 entry_point = 0x7ffda6ba2790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 1135 start_va = 0x7ffda6bb0000 end_va = 0x7ffda6bd3fff monitored = 0 entry_point = 0x7ffda6bb3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1136 start_va = 0x7ffda6d50000 end_va = 0x7ffda6e43fff monitored = 0 entry_point = 0x7ffda6d5a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1137 start_va = 0x7ffda6ea0000 end_va = 0x7ffda6ee8fff monitored = 0 entry_point = 0x7ffda6eaa090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1138 start_va = 0x7ffda6fc0000 end_va = 0x7ffda6fcbfff monitored = 0 entry_point = 0x7ffda6fc27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1139 start_va = 0x7ffda70a0000 end_va = 0x7ffda70d0fff monitored = 0 entry_point = 0x7ffda70a7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1140 start_va = 0x7ffda7100000 end_va = 0x7ffda7179fff monitored = 0 entry_point = 0x7ffda7121a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1141 start_va = 0x7ffda71c0000 end_va = 0x7ffda71f3fff monitored = 0 entry_point = 0x7ffda71dae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1142 start_va = 0x7ffda7200000 end_va = 0x7ffda7209fff monitored = 0 entry_point = 0x7ffda7201830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 1143 start_va = 0x7ffda7310000 end_va = 0x7ffda732efff monitored = 0 entry_point = 0x7ffda7315d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1144 start_va = 0x7ffda7480000 end_va = 0x7ffda74dbfff monitored = 0 entry_point = 0x7ffda7496f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1145 start_va = 0x7ffda7530000 end_va = 0x7ffda7546fff monitored = 0 entry_point = 0x7ffda75379d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1146 start_va = 0x7ffda7650000 end_va = 0x7ffda765afff monitored = 0 entry_point = 0x7ffda76519a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1147 start_va = 0x7ffda7690000 end_va = 0x7ffda76b0fff monitored = 0 entry_point = 0x7ffda76a0250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 1148 start_va = 0x7ffda76e0000 end_va = 0x7ffda7719fff monitored = 0 entry_point = 0x7ffda76e8d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 1149 start_va = 0x7ffda7720000 end_va = 0x7ffda7746fff monitored = 0 entry_point = 0x7ffda7730aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1150 start_va = 0x7ffda7830000 end_va = 0x7ffda785cfff monitored = 0 entry_point = 0x7ffda7849d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1151 start_va = 0x7ffda79c0000 end_va = 0x7ffda7a15fff monitored = 0 entry_point = 0x7ffda79d0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1152 start_va = 0x7ffda7a20000 end_va = 0x7ffda7a38fff monitored = 0 entry_point = 0x7ffda7a25e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 1153 start_va = 0x7ffda7a40000 end_va = 0x7ffda7a68fff monitored = 0 entry_point = 0x7ffda7a54530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1154 start_va = 0x7ffda7a70000 end_va = 0x7ffda7b08fff monitored = 0 entry_point = 0x7ffda7a9f4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1155 start_va = 0x7ffda7bb0000 end_va = 0x7ffda7bfafff monitored = 0 entry_point = 0x7ffda7bb35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1156 start_va = 0x7ffda7c00000 end_va = 0x7ffda7c0efff monitored = 0 entry_point = 0x7ffda7c03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1157 start_va = 0x7ffda7c10000 end_va = 0x7ffda7c23fff monitored = 0 entry_point = 0x7ffda7c152e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1158 start_va = 0x7ffda7c30000 end_va = 0x7ffda7c3ffff monitored = 0 entry_point = 0x7ffda7c356e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1159 start_va = 0x7ffda7c40000 end_va = 0x7ffda7cc5fff monitored = 0 entry_point = 0x7ffda7c4d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1160 start_va = 0x7ffda7cd0000 end_va = 0x7ffda7d39fff monitored = 0 entry_point = 0x7ffda7d06d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1161 start_va = 0x7ffda7d40000 end_va = 0x7ffda7f27fff monitored = 0 entry_point = 0x7ffda7d6ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1162 start_va = 0x7ffda7f30000 end_va = 0x7ffda80f6fff monitored = 0 entry_point = 0x7ffda7f8db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1163 start_va = 0x7ffda8100000 end_va = 0x7ffda8142fff monitored = 0 entry_point = 0x7ffda8114b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1164 start_va = 0x7ffda8150000 end_va = 0x7ffda81a4fff monitored = 0 entry_point = 0x7ffda8167970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1165 start_va = 0x7ffda8260000 end_va = 0x7ffda8314fff monitored = 0 entry_point = 0x7ffda82a22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1166 start_va = 0x7ffda8320000 end_va = 0x7ffda8963fff monitored = 0 entry_point = 0x7ffda84e64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1167 start_va = 0x7ffda8970000 end_va = 0x7ffda8986fff monitored = 0 entry_point = 0x7ffda8971390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1168 start_va = 0x7ffda8990000 end_va = 0x7ffda89ebfff monitored = 0 entry_point = 0x7ffda89ab720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1169 start_va = 0x7ffda8a30000 end_va = 0x7ffda8adcfff monitored = 0 entry_point = 0x7ffda8a481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1170 start_va = 0x7ffda8ae0000 end_va = 0x7ffda8b86fff monitored = 0 entry_point = 0x7ffda8aeb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1171 start_va = 0x7ffda8b90000 end_va = 0x7ffda8b97fff monitored = 0 entry_point = 0x7ffda8b91ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1172 start_va = 0x7ffda8ba0000 end_va = 0x7ffda8cbbfff monitored = 0 entry_point = 0x7ffda8be02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1173 start_va = 0x7ffda8cc0000 end_va = 0x7ffda8d80fff monitored = 0 entry_point = 0x7ffda8ce0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1174 start_va = 0x7ffda8ea0000 end_va = 0x7ffda8ff5fff monitored = 0 entry_point = 0x7ffda8eaa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1175 start_va = 0x7ffda9000000 end_va = 0x7ffda927cfff monitored = 0 entry_point = 0x7ffda90d4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1176 start_va = 0x7ffda9280000 end_va = 0x7ffda96a8fff monitored = 0 entry_point = 0x7ffda92a8740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1177 start_va = 0x7ffda96b0000 end_va = 0x7ffda97f2fff monitored = 0 entry_point = 0x7ffda96d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1178 start_va = 0x7ffda9800000 end_va = 0x7ffda986afff monitored = 0 entry_point = 0x7ffda98190c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1179 start_va = 0x7ffda9870000 end_va = 0x7ffdaadcefff monitored = 0 entry_point = 0x7ffda99d11f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1180 start_va = 0x7ffdaadd0000 end_va = 0x7ffdaae21fff monitored = 0 entry_point = 0x7ffdaaddf530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1181 start_va = 0x7ffdaae30000 end_va = 0x7ffdaaeccfff monitored = 0 entry_point = 0x7ffdaae378a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1182 start_va = 0x7ffdaaee0000 end_va = 0x7ffdaaf86fff monitored = 0 entry_point = 0x7ffdaaef58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1183 start_va = 0x7ffdab030000 end_va = 0x7ffdab08afff monitored = 0 entry_point = 0x7ffdab0438b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1184 start_va = 0x7ffdab400000 end_va = 0x7ffdab585fff monitored = 0 entry_point = 0x7ffdab44ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1185 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1217 start_va = 0x7a20000 end_va = 0x7b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a20000" filename = "" Region: id = 1218 start_va = 0x7c20000 end_va = 0x7d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c20000" filename = "" Region: id = 1219 start_va = 0x8020000 end_va = 0x811ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008020000" filename = "" Region: id = 1220 start_va = 0x8120000 end_va = 0x821ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008120000" filename = "" Region: id = 1314 start_va = 0x8420000 end_va = 0x851ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008420000" filename = "" Region: id = 1344 start_va = 0x120000 end_va = 0x124fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 1346 start_va = 0x120000 end_va = 0x124fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 1766 start_va = 0x120000 end_va = 0x122fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 1767 start_va = 0x170000 end_va = 0x172fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 1771 start_va = 0xfd0000 end_va = 0xfe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fd0000" filename = "" Region: id = 1773 start_va = 0x8520000 end_va = 0x861ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008520000" filename = "" Region: id = 1774 start_va = 0x8620000 end_va = 0x871ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008620000" filename = "" Region: id = 1775 start_va = 0x8720000 end_va = 0x881ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008720000" filename = "" Region: id = 1776 start_va = 0x8820000 end_va = 0x891ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008820000" filename = "" Region: id = 1783 start_va = 0xfd0000 end_va = 0xfe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000fd0000" filename = "" Region: id = 1785 start_va = 0x120000 end_va = 0x122fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 1787 start_va = 0x170000 end_va = 0x172fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2175 start_va = 0x120000 end_va = 0x121fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2176 start_va = 0x120000 end_va = 0x122fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2177 start_va = 0x120000 end_va = 0x122fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2186 start_va = 0x8920000 end_va = 0x8a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008920000" filename = "" Region: id = 2187 start_va = 0x120000 end_va = 0x122fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2247 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2257 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Thread: id = 21 os_tid = 0xf6c Thread: id = 22 os_tid = 0xe28 Thread: id = 23 os_tid = 0xbe0 Thread: id = 24 os_tid = 0xbe8 Thread: id = 25 os_tid = 0x340 Thread: id = 26 os_tid = 0x7c4 Thread: id = 27 os_tid = 0x3b4 Thread: id = 28 os_tid = 0x748 Thread: id = 29 os_tid = 0xfb4 Thread: id = 30 os_tid = 0xfa0 Thread: id = 31 os_tid = 0xf98 Thread: id = 32 os_tid = 0xf90 Thread: id = 33 os_tid = 0xf84 Thread: id = 34 os_tid = 0xf80 Thread: id = 35 os_tid = 0x2f8 Thread: id = 36 os_tid = 0x948 Thread: id = 37 os_tid = 0xf10 Thread: id = 38 os_tid = 0xbcc Thread: id = 39 os_tid = 0xcd4 Thread: id = 40 os_tid = 0x84 Thread: id = 41 os_tid = 0xadc Thread: id = 42 os_tid = 0xda8 Thread: id = 43 os_tid = 0x650 Thread: id = 44 os_tid = 0x338 Thread: id = 45 os_tid = 0xea4 Thread: id = 46 os_tid = 0xca0 Thread: id = 47 os_tid = 0xd08 Thread: id = 48 os_tid = 0xa7c Thread: id = 49 os_tid = 0xdb8 Thread: id = 50 os_tid = 0x910 Thread: id = 51 os_tid = 0xdd0 Thread: id = 52 os_tid = 0xdd4 Thread: id = 53 os_tid = 0xdd8 Thread: id = 54 os_tid = 0xd6c Thread: id = 55 os_tid = 0xc74 Thread: id = 56 os_tid = 0xc20 Thread: id = 57 os_tid = 0xc54 Thread: id = 58 os_tid = 0xffc Thread: id = 59 os_tid = 0xff8 Thread: id = 60 os_tid = 0xfd8 Thread: id = 61 os_tid = 0xcac Thread: id = 62 os_tid = 0x6c4 Thread: id = 63 os_tid = 0x8ac Thread: id = 64 os_tid = 0x8a4 Thread: id = 65 os_tid = 0x8a0 Thread: id = 66 os_tid = 0x878 Thread: id = 67 os_tid = 0x860 Thread: id = 68 os_tid = 0x858 Thread: id = 69 os_tid = 0x854 Thread: id = 70 os_tid = 0x814 Thread: id = 71 os_tid = 0x808 Thread: id = 72 os_tid = 0x500 Thread: id = 73 os_tid = 0x554 Thread: id = 74 os_tid = 0x4f4 Thread: id = 75 os_tid = 0x520 Thread: id = 76 os_tid = 0x524 Thread: id = 77 os_tid = 0x774 Thread: id = 78 os_tid = 0x460 Thread: id = 79 os_tid = 0x574 Thread: id = 80 os_tid = 0x4e8 Thread: id = 81 os_tid = 0x760 Thread: id = 82 os_tid = 0x718 Thread: id = 83 os_tid = 0x6c0 Thread: id = 84 os_tid = 0x694 Thread: id = 85 os_tid = 0x618 Thread: id = 86 os_tid = 0x608 Thread: id = 87 os_tid = 0x59c Thread: id = 88 os_tid = 0x4fc Thread: id = 89 os_tid = 0x4bc Thread: id = 90 os_tid = 0x4a8 Thread: id = 91 os_tid = 0x478 Thread: id = 92 os_tid = 0x2e4 Thread: id = 93 os_tid = 0x8 Thread: id = 94 os_tid = 0x2f0 Thread: id = 95 os_tid = 0x308 Thread: id = 96 os_tid = 0x270 Thread: id = 97 os_tid = 0x210 Thread: id = 98 os_tid = 0x18c Thread: id = 99 os_tid = 0x140 Thread: id = 100 os_tid = 0x3f4 Thread: id = 101 os_tid = 0x3ec Thread: id = 102 os_tid = 0x3e4 Thread: id = 103 os_tid = 0x368 Thread: id = 120 os_tid = 0x12ec Thread: id = 121 os_tid = 0x11f8 Thread: id = 122 os_tid = 0x12e4 Thread: id = 123 os_tid = 0x12e8 Thread: id = 124 os_tid = 0x1320 Thread: id = 129 os_tid = 0xb40 Thread: id = 130 os_tid = 0x6cc Thread: id = 131 os_tid = 0xc40 Thread: id = 132 os_tid = 0x794 Thread: id = 140 os_tid = 0x438 Process: id = "4" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x65ece000" os_pid = "0xaf0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x274" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xe], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xe], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ac37" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1360 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1361 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1362 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1363 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1364 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1365 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1366 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1367 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1368 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1369 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1370 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1371 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1372 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1373 start_va = 0x480000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 1374 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1375 start_va = 0x550000 end_va = 0x554fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1376 start_va = 0x560000 end_va = 0x560fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 1377 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1378 start_va = 0x580000 end_va = 0x580fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 1379 start_va = 0x590000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 1380 start_va = 0x690000 end_va = 0x817fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 1381 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1382 start_va = 0x830000 end_va = 0xb66fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1383 start_va = 0xb70000 end_va = 0xcf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b70000" filename = "" Region: id = 1384 start_va = 0xd00000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 1385 start_va = 0xd80000 end_va = 0xe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 1386 start_va = 0xe80000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 1387 start_va = 0xf00000 end_va = 0xf7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 1388 start_va = 0xf80000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f80000" filename = "" Region: id = 1389 start_va = 0x1000000 end_va = 0x107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 1390 start_va = 0x1080000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001080000" filename = "" Region: id = 1391 start_va = 0x1100000 end_va = 0x117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 1392 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1393 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1394 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1395 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1396 start_va = 0x7ff61e550000 end_va = 0x7ff61e5cffff monitored = 0 entry_point = 0x7ff61e565f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1397 start_va = 0x7ffd8b170000 end_va = 0x7ffd8b1bcfff monitored = 0 entry_point = 0x7ffd8b17b470 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 1398 start_va = 0x7ffd8eea0000 end_va = 0x7ffd8eec4fff monitored = 1 entry_point = 0x7ffd8eeb5dc0 region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 1399 start_va = 0x7ffd97150000 end_va = 0x7ffd97165fff monitored = 0 entry_point = 0x7ffd971555e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1400 start_va = 0x7ffd972c0000 end_va = 0x7ffd972e4fff monitored = 0 entry_point = 0x7ffd972c9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1401 start_va = 0x7ffd972f0000 end_va = 0x7ffd97303fff monitored = 0 entry_point = 0x7ffd972f1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1402 start_va = 0x7ffd97350000 end_va = 0x7ffd97445fff monitored = 0 entry_point = 0x7ffd97389590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1403 start_va = 0x7ffd97630000 end_va = 0x7ffd97640fff monitored = 0 entry_point = 0x7ffd97632fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1404 start_va = 0x7ffd9b340000 end_va = 0x7ffd9b3befff monitored = 1 entry_point = 0x7ffd9b357110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1405 start_va = 0x7ffd9fe60000 end_va = 0x7ffd9fe9cfff monitored = 1 entry_point = 0x7ffd9fe6b760 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 1406 start_va = 0x7ffda1ea0000 end_va = 0x7ffda1eb0fff monitored = 0 entry_point = 0x7ffda1ea3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1407 start_va = 0x7ffda40c0000 end_va = 0x7ffda4123fff monitored = 0 entry_point = 0x7ffda40d5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1408 start_va = 0x7ffda70a0000 end_va = 0x7ffda70d0fff monitored = 0 entry_point = 0x7ffda70a7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1409 start_va = 0x7ffda7a40000 end_va = 0x7ffda7a68fff monitored = 0 entry_point = 0x7ffda7a54530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1410 start_va = 0x7ffda7c00000 end_va = 0x7ffda7c0efff monitored = 0 entry_point = 0x7ffda7c03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1411 start_va = 0x7ffda7cd0000 end_va = 0x7ffda7d39fff monitored = 0 entry_point = 0x7ffda7d06d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1412 start_va = 0x7ffda7d40000 end_va = 0x7ffda7f27fff monitored = 0 entry_point = 0x7ffda7d6ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1413 start_va = 0x7ffda8a30000 end_va = 0x7ffda8adcfff monitored = 0 entry_point = 0x7ffda8a481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1414 start_va = 0x7ffda8ae0000 end_va = 0x7ffda8b86fff monitored = 0 entry_point = 0x7ffda8aeb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1415 start_va = 0x7ffda8ba0000 end_va = 0x7ffda8cbbfff monitored = 0 entry_point = 0x7ffda8be02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1416 start_va = 0x7ffda8cc0000 end_va = 0x7ffda8d80fff monitored = 0 entry_point = 0x7ffda8ce0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1417 start_va = 0x7ffda8ea0000 end_va = 0x7ffda8ff5fff monitored = 0 entry_point = 0x7ffda8eaa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1418 start_va = 0x7ffda9000000 end_va = 0x7ffda927cfff monitored = 0 entry_point = 0x7ffda90d4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1419 start_va = 0x7ffda9800000 end_va = 0x7ffda986afff monitored = 0 entry_point = 0x7ffda98190c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1420 start_va = 0x7ffdaae30000 end_va = 0x7ffdaaeccfff monitored = 0 entry_point = 0x7ffdaae378a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1421 start_va = 0x7ffdaaee0000 end_va = 0x7ffdaaf86fff monitored = 0 entry_point = 0x7ffdaaef58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1422 start_va = 0x7ffdab030000 end_va = 0x7ffdab08afff monitored = 0 entry_point = 0x7ffdab0438b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1423 start_va = 0x7ffdab400000 end_va = 0x7ffdab585fff monitored = 0 entry_point = 0x7ffdab44ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1424 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 104 os_tid = 0xf8c Thread: id = 105 os_tid = 0x7b4 Thread: id = 106 os_tid = 0xb5c Thread: id = 107 os_tid = 0xe50 Thread: id = 108 os_tid = 0xf3c Thread: id = 109 os_tid = 0x830 Thread: id = 110 os_tid = 0x9e8 Thread: id = 111 os_tid = 0xb6c Process: id = "5" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x2010b000" os_pid = "0xe18" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x274" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00038627" [0xc000000f] Region: id = 1221 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1222 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1223 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1224 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1225 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1226 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1227 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1228 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1229 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1230 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1231 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1232 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1233 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1234 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 1235 start_va = 0x410000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1236 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1237 start_va = 0x430000 end_va = 0x430fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 1238 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 1239 start_va = 0x450000 end_va = 0x452fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 1240 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 1241 start_va = 0x470000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 1242 start_va = 0x5f0000 end_va = 0x926fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1243 start_va = 0x930000 end_va = 0xab7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 1244 start_va = 0xac0000 end_va = 0xc40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 1245 start_va = 0xc50000 end_va = 0xd0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c50000" filename = "" Region: id = 1246 start_va = 0xd90000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 1247 start_va = 0xe90000 end_va = 0xf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 1248 start_va = 0xf90000 end_va = 0x100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 1249 start_va = 0x1010000 end_va = 0x108ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 1250 start_va = 0x1110000 end_va = 0x118ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 1251 start_va = 0x1290000 end_va = 0x130ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001290000" filename = "" Region: id = 1252 start_va = 0x1310000 end_va = 0x138ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001310000" filename = "" Region: id = 1253 start_va = 0x1390000 end_va = 0x140ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001390000" filename = "" Region: id = 1254 start_va = 0x1490000 end_va = 0x150ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001490000" filename = "" Region: id = 1255 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1256 start_va = 0x180000000 end_va = 0x180002fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 1257 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1258 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1259 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1260 start_va = 0x7ff61e550000 end_va = 0x7ff61e5cffff monitored = 0 entry_point = 0x7ff61e565f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1261 start_va = 0x7ffd8ecc0000 end_va = 0x7ffd8ee8efff monitored = 1 entry_point = 0x7ffd8ece7df0 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 1262 start_va = 0x7ffd91320000 end_va = 0x7ffd9136dfff monitored = 0 entry_point = 0x7ffd91331ce0 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1263 start_va = 0x7ffd92210000 end_va = 0x7ffd9221dfff monitored = 0 entry_point = 0x7ffd92211da0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1264 start_va = 0x7ffd92550000 end_va = 0x7ffd92563fff monitored = 0 entry_point = 0x7ffd92551310 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 1265 start_va = 0x7ffd97150000 end_va = 0x7ffd97165fff monitored = 0 entry_point = 0x7ffd971555e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1266 start_va = 0x7ffd972c0000 end_va = 0x7ffd972e4fff monitored = 0 entry_point = 0x7ffd972c9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1267 start_va = 0x7ffd972f0000 end_va = 0x7ffd97303fff monitored = 0 entry_point = 0x7ffd972f1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1268 start_va = 0x7ffd97350000 end_va = 0x7ffd97445fff monitored = 0 entry_point = 0x7ffd97389590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1269 start_va = 0x7ffd982b0000 end_va = 0x7ffd982d5fff monitored = 0 entry_point = 0x7ffd982b1cf0 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1270 start_va = 0x7ffd9b340000 end_va = 0x7ffd9b3befff monitored = 1 entry_point = 0x7ffd9b357110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1271 start_va = 0x7ffd9b400000 end_va = 0x7ffd9b40bfff monitored = 0 entry_point = 0x7ffd9b4035c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1272 start_va = 0x7ffd9f020000 end_va = 0x7ffd9f031fff monitored = 0 entry_point = 0x7ffd9f023580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1273 start_va = 0x7ffd9f190000 end_va = 0x7ffd9f19afff monitored = 0 entry_point = 0x7ffd9f1912b0 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 1274 start_va = 0x7ffda11c0000 end_va = 0x7ffda11d8fff monitored = 0 entry_point = 0x7ffda11c4520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1275 start_va = 0x7ffda18b0000 end_va = 0x7ffda18c5fff monitored = 0 entry_point = 0x7ffda18b1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1276 start_va = 0x7ffda3fe0000 end_va = 0x7ffda401dfff monitored = 0 entry_point = 0x7ffda3fea050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1277 start_va = 0x7ffda4d20000 end_va = 0x7ffda4d29fff monitored = 0 entry_point = 0x7ffda4d21660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1278 start_va = 0x7ffda62f0000 end_va = 0x7ffda6302fff monitored = 0 entry_point = 0x7ffda62f2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1279 start_va = 0x7ffda65d0000 end_va = 0x7ffda65f6fff monitored = 0 entry_point = 0x7ffda65d7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1280 start_va = 0x7ffda6fc0000 end_va = 0x7ffda6fcbfff monitored = 0 entry_point = 0x7ffda6fc27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1281 start_va = 0x7ffda7100000 end_va = 0x7ffda7179fff monitored = 0 entry_point = 0x7ffda7121a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1282 start_va = 0x7ffda7830000 end_va = 0x7ffda785cfff monitored = 0 entry_point = 0x7ffda7849d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1283 start_va = 0x7ffda79c0000 end_va = 0x7ffda7a15fff monitored = 0 entry_point = 0x7ffda79d0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1284 start_va = 0x7ffda7a40000 end_va = 0x7ffda7a68fff monitored = 0 entry_point = 0x7ffda7a54530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1285 start_va = 0x7ffda7bb0000 end_va = 0x7ffda7bfafff monitored = 0 entry_point = 0x7ffda7bb35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1286 start_va = 0x7ffda7c00000 end_va = 0x7ffda7c0efff monitored = 0 entry_point = 0x7ffda7c03210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1287 start_va = 0x7ffda7c30000 end_va = 0x7ffda7c3ffff monitored = 0 entry_point = 0x7ffda7c356e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1288 start_va = 0x7ffda7cd0000 end_va = 0x7ffda7d39fff monitored = 0 entry_point = 0x7ffda7d06d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1289 start_va = 0x7ffda7d40000 end_va = 0x7ffda7f27fff monitored = 0 entry_point = 0x7ffda7d6ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1290 start_va = 0x7ffda7f30000 end_va = 0x7ffda80f6fff monitored = 0 entry_point = 0x7ffda7f8db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1291 start_va = 0x7ffda8100000 end_va = 0x7ffda8142fff monitored = 0 entry_point = 0x7ffda8114b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1292 start_va = 0x7ffda8970000 end_va = 0x7ffda8986fff monitored = 0 entry_point = 0x7ffda8971390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1293 start_va = 0x7ffda8a30000 end_va = 0x7ffda8adcfff monitored = 0 entry_point = 0x7ffda8a481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1294 start_va = 0x7ffda8ae0000 end_va = 0x7ffda8b86fff monitored = 0 entry_point = 0x7ffda8aeb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1295 start_va = 0x7ffda8ba0000 end_va = 0x7ffda8cbbfff monitored = 0 entry_point = 0x7ffda8be02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1296 start_va = 0x7ffda8cc0000 end_va = 0x7ffda8d80fff monitored = 0 entry_point = 0x7ffda8ce0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1297 start_va = 0x7ffda8ea0000 end_va = 0x7ffda8ff5fff monitored = 0 entry_point = 0x7ffda8eaa8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1298 start_va = 0x7ffda9000000 end_va = 0x7ffda927cfff monitored = 0 entry_point = 0x7ffda90d4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1299 start_va = 0x7ffda9800000 end_va = 0x7ffda986afff monitored = 0 entry_point = 0x7ffda98190c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1300 start_va = 0x7ffdaae30000 end_va = 0x7ffdaaeccfff monitored = 0 entry_point = 0x7ffdaae378a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1301 start_va = 0x7ffdaaee0000 end_va = 0x7ffdaaf86fff monitored = 0 entry_point = 0x7ffdaaef58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1302 start_va = 0x7ffdab030000 end_va = 0x7ffdab08afff monitored = 0 entry_point = 0x7ffdab0438b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1303 start_va = 0x7ffdab400000 end_va = 0x7ffdab585fff monitored = 0 entry_point = 0x7ffdab44ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1304 start_va = 0x7ffdab590000 end_va = 0x7ffdab750fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1305 start_va = 0x570000 end_va = 0x572fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1347 start_va = 0x570000 end_va = 0x571fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1348 start_va = 0x580000 end_va = 0x584fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 1349 start_va = 0x1190000 end_va = 0x128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001190000" filename = "" Region: id = 1350 start_va = 0x580000 end_va = 0x595fff monitored = 0 entry_point = 0x590420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1351 start_va = 0x5a0000 end_va = 0x5a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1352 start_va = 0x570000 end_va = 0x585fff monitored = 0 entry_point = 0x580420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1353 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1354 start_va = 0x570000 end_va = 0x585fff monitored = 0 entry_point = 0x580420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1355 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1356 start_va = 0x570000 end_va = 0x585fff monitored = 0 entry_point = 0x580420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1357 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1358 start_va = 0x570000 end_va = 0x589fff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1359 start_va = 0x590000 end_va = 0x595fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1425 start_va = 0x570000 end_va = 0x589fff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1426 start_va = 0x590000 end_va = 0x595fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1427 start_va = 0x570000 end_va = 0x59afff monitored = 0 entry_point = 0x58d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1428 start_va = 0x5a0000 end_va = 0x5a4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1429 start_va = 0x15d0000 end_va = 0x19cafff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015d0000" filename = "" Region: id = 1430 start_va = 0x570000 end_va = 0x59afff monitored = 0 entry_point = 0x58d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1431 start_va = 0x5a0000 end_va = 0x5a4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1432 start_va = 0x570000 end_va = 0x59afff monitored = 0 entry_point = 0x58d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1433 start_va = 0x5a0000 end_va = 0x5a4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1434 start_va = 0x570000 end_va = 0x59afff monitored = 0 entry_point = 0x58d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1435 start_va = 0x5a0000 end_va = 0x5a4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1436 start_va = 0x570000 end_va = 0x598fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1437 start_va = 0x19d0000 end_va = 0x1ab3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1438 start_va = 0x570000 end_va = 0x598fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1439 start_va = 0x19d0000 end_va = 0x1ab3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1440 start_va = 0x570000 end_va = 0x575fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1441 start_va = 0x1510000 end_va = 0x15a2fff monitored = 0 entry_point = 0x1589000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1442 start_va = 0x570000 end_va = 0x575fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1443 start_va = 0x1510000 end_va = 0x15a2fff monitored = 0 entry_point = 0x1589000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1444 start_va = 0x570000 end_va = 0x575fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1445 start_va = 0x1510000 end_va = 0x15b0fff monitored = 0 entry_point = 0x15a3000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1446 start_va = 0x570000 end_va = 0x575fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1447 start_va = 0x1510000 end_va = 0x15b0fff monitored = 0 entry_point = 0x15a3000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1448 start_va = 0x570000 end_va = 0x57afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1449 start_va = 0x1510000 end_va = 0x1595fff monitored = 0 entry_point = 0x1581000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1450 start_va = 0x570000 end_va = 0x57afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1451 start_va = 0x1510000 end_va = 0x1595fff monitored = 0 entry_point = 0x1581000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1452 start_va = 0x570000 end_va = 0x57afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1453 start_va = 0x1510000 end_va = 0x1595fff monitored = 0 entry_point = 0x1581000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1454 start_va = 0x570000 end_va = 0x57afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1455 start_va = 0x1510000 end_va = 0x1595fff monitored = 0 entry_point = 0x1581000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1456 start_va = 0x570000 end_va = 0x57efff monitored = 0 entry_point = 0x5736e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 1457 start_va = 0x580000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 1458 start_va = 0x570000 end_va = 0x57efff monitored = 0 entry_point = 0x5736e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 1459 start_va = 0x580000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 1460 start_va = 0x570000 end_va = 0x58afff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1461 start_va = 0x590000 end_va = 0x59bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1462 start_va = 0x570000 end_va = 0x58afff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1463 start_va = 0x590000 end_va = 0x59bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1464 start_va = 0x570000 end_va = 0x58afff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1465 start_va = 0x590000 end_va = 0x59bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1466 start_va = 0x570000 end_va = 0x58afff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1467 start_va = 0x590000 end_va = 0x59bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1468 start_va = 0x570000 end_va = 0x58afff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1469 start_va = 0x590000 end_va = 0x59bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1470 start_va = 0x570000 end_va = 0x58afff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1471 start_va = 0x590000 end_va = 0x59bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1472 start_va = 0x570000 end_va = 0x571fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1473 start_va = 0x19d0000 end_va = 0x1adefff monitored = 0 entry_point = 0x1a0c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1474 start_va = 0x570000 end_va = 0x571fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1475 start_va = 0x19d0000 end_va = 0x1adefff monitored = 0 entry_point = 0x1a0c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1476 start_va = 0x570000 end_va = 0x586fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1477 start_va = 0x19d0000 end_va = 0x1c26fff monitored = 0 entry_point = 0x1bdce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1478 start_va = 0x570000 end_va = 0x586fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1479 start_va = 0x19d0000 end_va = 0x1c26fff monitored = 0 entry_point = 0x1bdce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1480 start_va = 0x570000 end_va = 0x579fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1481 start_va = 0x19d0000 end_va = 0x1ae0fff monitored = 0 entry_point = 0x1ac1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1482 start_va = 0x570000 end_va = 0x579fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1483 start_va = 0x19d0000 end_va = 0x1ae0fff monitored = 0 entry_point = 0x1ac1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1484 start_va = 0x570000 end_va = 0x579fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1485 start_va = 0x19d0000 end_va = 0x1ae0fff monitored = 0 entry_point = 0x1ac1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1486 start_va = 0x570000 end_va = 0x579fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1487 start_va = 0x19d0000 end_va = 0x1ae0fff monitored = 0 entry_point = 0x1ac1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1488 start_va = 0x570000 end_va = 0x579fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1489 start_va = 0x19d0000 end_va = 0x1ae0fff monitored = 0 entry_point = 0x1ac1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1490 start_va = 0x570000 end_va = 0x579fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1491 start_va = 0x19d0000 end_va = 0x1ae0fff monitored = 0 entry_point = 0x1ac1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1492 start_va = 0x570000 end_va = 0x57ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1493 start_va = 0x580000 end_va = 0x58dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1494 start_va = 0x570000 end_va = 0x57ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1495 start_va = 0x580000 end_va = 0x58dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1496 start_va = 0x570000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1497 start_va = 0x1510000 end_va = 0x15befff monitored = 0 entry_point = 0x1587000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1498 start_va = 0x570000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1499 start_va = 0x1510000 end_va = 0x15befff monitored = 0 entry_point = 0x1587000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1500 start_va = 0x570000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1501 start_va = 0x1510000 end_va = 0x15befff monitored = 0 entry_point = 0x1587000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1502 start_va = 0x570000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1503 start_va = 0x1510000 end_va = 0x15befff monitored = 0 entry_point = 0x1587000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1504 start_va = 0x570000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1505 start_va = 0x1510000 end_va = 0x15befff monitored = 0 entry_point = 0x1587000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1506 start_va = 0x570000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1507 start_va = 0x1510000 end_va = 0x15befff monitored = 0 entry_point = 0x1587000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1508 start_va = 0x570000 end_va = 0x5d0fff monitored = 0 entry_point = 0x580770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1509 start_va = 0x5e0000 end_va = 0x5e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1510 start_va = 0x570000 end_va = 0x5d0fff monitored = 0 entry_point = 0x580770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1511 start_va = 0x5e0000 end_va = 0x5e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1512 start_va = 0x570000 end_va = 0x5d0fff monitored = 0 entry_point = 0x580770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1513 start_va = 0x5e0000 end_va = 0x5e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1514 start_va = 0x570000 end_va = 0x5d0fff monitored = 0 entry_point = 0x580770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1515 start_va = 0x5e0000 end_va = 0x5e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1516 start_va = 0x570000 end_va = 0x5d0fff monitored = 0 entry_point = 0x580770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1517 start_va = 0x5e0000 end_va = 0x5e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1518 start_va = 0x570000 end_va = 0x5d0fff monitored = 0 entry_point = 0x580770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1519 start_va = 0x5e0000 end_va = 0x5e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1520 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1521 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1522 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1523 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1524 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1525 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1526 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1527 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1528 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1529 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1530 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1531 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1532 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1533 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1534 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1535 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1536 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1537 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1538 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1539 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1540 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1541 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1542 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1543 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1544 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1545 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1546 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1547 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1548 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1549 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1550 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1551 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1552 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1553 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1554 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1555 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1556 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1557 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1558 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1559 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1560 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1561 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1562 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1563 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1564 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1565 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1566 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1567 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1568 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1569 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1570 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1571 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1572 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1573 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1574 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1575 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1576 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1577 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1578 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1579 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1580 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1581 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1582 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1583 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1584 start_va = 0x570000 end_va = 0x5e1fff monitored = 0 entry_point = 0x5c7000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1585 start_va = 0xd10000 end_va = 0xd1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1586 start_va = 0x570000 end_va = 0x5e1fff monitored = 0 entry_point = 0x5c7000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1587 start_va = 0xd10000 end_va = 0xd1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1588 start_va = 0x570000 end_va = 0x585fff monitored = 0 entry_point = 0x580420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1589 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1590 start_va = 0x570000 end_va = 0x585fff monitored = 0 entry_point = 0x580420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1591 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1592 start_va = 0x570000 end_va = 0x585fff monitored = 0 entry_point = 0x580420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1593 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1594 start_va = 0x570000 end_va = 0x585fff monitored = 0 entry_point = 0x580420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1595 start_va = 0x590000 end_va = 0x592fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1596 start_va = 0x570000 end_va = 0x589fff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1597 start_va = 0x590000 end_va = 0x595fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1598 start_va = 0x570000 end_va = 0x589fff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1599 start_va = 0x590000 end_va = 0x595fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1600 start_va = 0x570000 end_va = 0x59afff monitored = 0 entry_point = 0x58d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1601 start_va = 0x5a0000 end_va = 0x5a4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1602 start_va = 0x570000 end_va = 0x59afff monitored = 0 entry_point = 0x58d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1603 start_va = 0x5a0000 end_va = 0x5a4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1604 start_va = 0x570000 end_va = 0x59afff monitored = 0 entry_point = 0x58d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1605 start_va = 0x5a0000 end_va = 0x5a4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1606 start_va = 0x570000 end_va = 0x59afff monitored = 0 entry_point = 0x58d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1607 start_va = 0x5a0000 end_va = 0x5a4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1608 start_va = 0x570000 end_va = 0x598fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1609 start_va = 0x19d0000 end_va = 0x1ab3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1610 start_va = 0x570000 end_va = 0x598fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1611 start_va = 0x19d0000 end_va = 0x1ab3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1612 start_va = 0x570000 end_va = 0x575fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1613 start_va = 0x1510000 end_va = 0x15a2fff monitored = 0 entry_point = 0x1589000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1614 start_va = 0x570000 end_va = 0x575fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1615 start_va = 0x1510000 end_va = 0x15a2fff monitored = 0 entry_point = 0x1589000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1616 start_va = 0x570000 end_va = 0x575fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1617 start_va = 0x1510000 end_va = 0x15b0fff monitored = 0 entry_point = 0x15a3000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1618 start_va = 0x570000 end_va = 0x575fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1619 start_va = 0x1510000 end_va = 0x15b0fff monitored = 0 entry_point = 0x15a3000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1620 start_va = 0x570000 end_va = 0x57afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1621 start_va = 0x1510000 end_va = 0x1595fff monitored = 0 entry_point = 0x1581000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1622 start_va = 0x570000 end_va = 0x57afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1623 start_va = 0x1510000 end_va = 0x1595fff monitored = 0 entry_point = 0x1581000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1624 start_va = 0x570000 end_va = 0x57afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1625 start_va = 0x1510000 end_va = 0x1595fff monitored = 0 entry_point = 0x1581000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1626 start_va = 0x570000 end_va = 0x57afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1627 start_va = 0x1510000 end_va = 0x1595fff monitored = 0 entry_point = 0x1581000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1628 start_va = 0x570000 end_va = 0x57efff monitored = 0 entry_point = 0x5736e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 1629 start_va = 0x580000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 1630 start_va = 0x570000 end_va = 0x58afff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1631 start_va = 0x590000 end_va = 0x59bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1632 start_va = 0x570000 end_va = 0x58afff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1633 start_va = 0x590000 end_va = 0x59bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1634 start_va = 0x570000 end_va = 0x58afff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1635 start_va = 0x590000 end_va = 0x59bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1636 start_va = 0x570000 end_va = 0x58afff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1637 start_va = 0x590000 end_va = 0x59bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1638 start_va = 0x570000 end_va = 0x58afff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1639 start_va = 0x590000 end_va = 0x59bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1640 start_va = 0x570000 end_va = 0x58afff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1641 start_va = 0x590000 end_va = 0x59bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1642 start_va = 0x570000 end_va = 0x58afff monitored = 1 entry_point = 0x571190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1643 start_va = 0x590000 end_va = 0x59bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1644 start_va = 0x570000 end_va = 0x571fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1645 start_va = 0x19d0000 end_va = 0x1adefff monitored = 0 entry_point = 0x1a0c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1646 start_va = 0x570000 end_va = 0x571fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1647 start_va = 0x19d0000 end_va = 0x1adefff monitored = 0 entry_point = 0x1a0c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1648 start_va = 0x570000 end_va = 0x586fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1649 start_va = 0x19d0000 end_va = 0x1c26fff monitored = 0 entry_point = 0x1bdce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1650 start_va = 0x570000 end_va = 0x586fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1651 start_va = 0x19d0000 end_va = 0x1c26fff monitored = 0 entry_point = 0x1bdce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1652 start_va = 0x570000 end_va = 0x579fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1653 start_va = 0x19d0000 end_va = 0x1ae0fff monitored = 0 entry_point = 0x1ac1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1654 start_va = 0x570000 end_va = 0x579fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1655 start_va = 0x19d0000 end_va = 0x1ae0fff monitored = 0 entry_point = 0x1ac1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1656 start_va = 0x570000 end_va = 0x579fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1657 start_va = 0x19d0000 end_va = 0x1ae0fff monitored = 0 entry_point = 0x1ac1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1658 start_va = 0x570000 end_va = 0x579fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1659 start_va = 0x19d0000 end_va = 0x1ae0fff monitored = 0 entry_point = 0x1ac1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1660 start_va = 0x570000 end_va = 0x579fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1661 start_va = 0x19d0000 end_va = 0x1ae0fff monitored = 0 entry_point = 0x1ac1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1662 start_va = 0x570000 end_va = 0x579fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1663 start_va = 0x19d0000 end_va = 0x1ae0fff monitored = 0 entry_point = 0x1ac1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1664 start_va = 0x570000 end_va = 0x57ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1665 start_va = 0x580000 end_va = 0x58dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1666 start_va = 0x570000 end_va = 0x57ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1667 start_va = 0x580000 end_va = 0x58dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1668 start_va = 0x570000 end_va = 0x57ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1669 start_va = 0x580000 end_va = 0x58dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1670 start_va = 0x570000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1671 start_va = 0x1510000 end_va = 0x15befff monitored = 0 entry_point = 0x1587000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1672 start_va = 0x570000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1673 start_va = 0x1510000 end_va = 0x15befff monitored = 0 entry_point = 0x1587000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1674 start_va = 0x570000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1675 start_va = 0x1510000 end_va = 0x15befff monitored = 0 entry_point = 0x1587000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1676 start_va = 0x570000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1677 start_va = 0x1510000 end_va = 0x15befff monitored = 0 entry_point = 0x1587000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1678 start_va = 0x570000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1679 start_va = 0x1510000 end_va = 0x15befff monitored = 0 entry_point = 0x1587000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1680 start_va = 0x570000 end_va = 0x581fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1681 start_va = 0x1510000 end_va = 0x15befff monitored = 0 entry_point = 0x1587000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1682 start_va = 0x570000 end_va = 0x5d0fff monitored = 0 entry_point = 0x580770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1683 start_va = 0x5e0000 end_va = 0x5e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1684 start_va = 0x570000 end_va = 0x5d0fff monitored = 0 entry_point = 0x580770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1685 start_va = 0x5e0000 end_va = 0x5e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1686 start_va = 0x570000 end_va = 0x5d0fff monitored = 0 entry_point = 0x580770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1687 start_va = 0x5e0000 end_va = 0x5e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1688 start_va = 0x570000 end_va = 0x5d0fff monitored = 0 entry_point = 0x580770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1689 start_va = 0x5e0000 end_va = 0x5e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1690 start_va = 0x570000 end_va = 0x5d0fff monitored = 0 entry_point = 0x580770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1691 start_va = 0x5e0000 end_va = 0x5e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1692 start_va = 0x570000 end_va = 0x5d0fff monitored = 0 entry_point = 0x580770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1693 start_va = 0x5e0000 end_va = 0x5e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1694 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1695 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1696 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1697 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1698 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1699 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1700 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1701 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1702 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1703 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1704 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1705 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1706 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1707 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1708 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1709 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1710 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1711 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1712 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1713 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1714 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1715 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1716 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1717 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1718 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1719 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1720 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1721 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1722 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1723 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1724 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1725 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1726 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1727 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1728 start_va = 0x570000 end_va = 0x580fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1729 start_va = 0x19d0000 end_va = 0x1aeffff monitored = 0 entry_point = 0x1acc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1730 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1731 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1732 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1733 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1734 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1735 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1736 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1737 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1738 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1739 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1740 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1741 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1742 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1743 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1744 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1745 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1746 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1747 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1748 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1749 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1750 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1751 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1752 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1753 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1754 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1755 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1756 start_va = 0x19d0000 end_va = 0x1bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019d0000" filename = "" Region: id = 1757 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1758 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1759 start_va = 0x570000 end_va = 0x572fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1760 start_va = 0x580000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1761 start_va = 0x570000 end_va = 0x5e1fff monitored = 0 entry_point = 0x5c7000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1762 start_va = 0xd10000 end_va = 0xd1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1763 start_va = 0x570000 end_va = 0x5e1fff monitored = 0 entry_point = 0x5c7000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1764 start_va = 0xd10000 end_va = 0xd1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1765 start_va = 0x7ffda02a0000 end_va = 0x7ffda02adfff monitored = 0 entry_point = 0x7ffda02a2b10 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Region: id = 1777 start_va = 0x570000 end_va = 0x572fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1778 start_va = 0x7ffda17d0000 end_va = 0x7ffda1807fff monitored = 0 entry_point = 0x7ffda17e8cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1779 start_va = 0x7ffda8b90000 end_va = 0x7ffda8b97fff monitored = 0 entry_point = 0x7ffda8b91ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1780 start_va = 0x1510000 end_va = 0x158ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 1781 start_va = 0x7ffda17b0000 end_va = 0x7ffda17c5fff monitored = 0 entry_point = 0x7ffda17b19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1782 start_va = 0x7ffda1790000 end_va = 0x7ffda17a9fff monitored = 0 entry_point = 0x7ffda1792430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1784 start_va = 0x7ffda6620000 end_va = 0x7ffda66c9fff monitored = 0 entry_point = 0x7ffda6647910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1786 start_va = 0x580000 end_va = 0x583fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Thread: id = 112 os_tid = 0x1354 Thread: id = 113 os_tid = 0xdcc Thread: id = 114 os_tid = 0xd00 [0211.280] LoadStringW (in: hInstance=0x7ffd8ecc0000, uID=0x3e, lpBuffer=0x138d6c0, cchBufferMax=256 | out: lpBuffer="Base Board") returned 0xa [0211.280] lstrlenW (lpString="Dell Inc.") returned 9 [0211.280] lstrlenW (lpString="0G3HR7") returned 6 [0211.280] lstrlenW (lpString="A00") returned 3 [0211.281] lstrlenW (lpString="..XXXXXXXXXXXXX.") returned 16 [0215.936] malloc (_Size=0x600) returned 0xde10a0 [0215.936] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0x138d7f8 | out: Buffer=0x0, ReturnedLength=0x138d7f8) returned 0 [0215.936] GetLastError () returned 0x7a [0215.936] malloc (_Size=0x250) returned 0xdb3ab0 [0215.936] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0xdb3ab0, ReturnedLength=0x138d7f8 | out: Buffer=0xdb3ab0, ReturnedLength=0x138d7f8) returned 1 [0215.936] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4 [0215.936] GetMaximumProcessorGroupCount () returned 0x1 [0215.937] malloc (_Size=0x40) returned 0xddfe70 [0215.937] malloc (_Size=0x40) returned 0xddfbf0 [0215.937] malloc (_Size=0x8) returned 0xdb3a20 [0215.937] memcpy (in: _Dst=0xddfe70, _Src=0xdb3ad0, _Size=0x10 | out: _Dst=0xddfe70) returned 0xddfe70 [0215.942] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4 [0215.943] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0x138d7f0, InputBufferLength=0x2, OutputBuffer=0xde10a0, OutputBufferLength=0x60 | out: OutputBuffer=0xde10a0) returned 0x0 [0215.943] _vsnwprintf (in: _Buffer=0x138d690, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x138cf88 | out: _Buffer="CPU0") returned 4 [0215.943] GetCurrentThread () returned 0xfffffffffffffffe [0215.943] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x138cee0, PreviousGroupAffinity=0x138cef0 | out: PreviousGroupAffinity=0x138cef0) returned 1 [0215.951] GetSystemInfo (in: lpSystemInfo=0x138d020 | out: lpSystemInfo=0x138d020*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0215.951] mbstowcs (in: _Dest=0x138d2a8, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc [0215.951] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0 [0215.953] mbstowcs (in: _Dest=0x138d118, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27 [0215.953] GetCurrentThread () returned 0xfffffffffffffffe [0215.953] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x138cef0, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1 [0215.954] LoadStringW (in: hInstance=0x7ffd8ecc0000, uID=0x2c, lpBuffer=0x138ccf0, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6 [0232.953] malloc (_Size=0x34c34) returned 0xde1fd0 [0232.969] _wtoi (_String="238") returned 238 [0232.969] _wtoi (_String="6") returned 6 [0232.969] _itow (in: _Dest=0x0, _Radix=20501952 | out: _Dest=0x0) returned="0" [0232.969] _itow (in: _Dest=0xee, _Radix=20500240 | out: _Dest=0xee) returned="238" [0232.969] malloc (_Size=0x4000) returned 0xe16c10 [0232.969] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe16c10, lpcbData=0x138cee4*=0x4000 | out: lpType=0x0, lpData=0xe16c10*=0x50, lpcbData=0x138cee4*=0x600) returned 0x0 [0233.107] free (_Block=0xe16c10) [0233.107] Sleep (dwMilliseconds=0x3e8) [0234.107] _itow (in: _Dest=0xee, _Radix=20500240 | out: _Dest=0xee) returned="238" [0234.108] malloc (_Size=0x4000) returned 0xe16c10 [0234.108] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe16c10, lpcbData=0x138cee4*=0x4000 | out: lpType=0x0, lpData=0xe16c10*=0x50, lpcbData=0x138cee4*=0x600) returned 0x0 [0234.185] free (_Block=0xe16c10) [0234.187] free (_Block=0xde1fd0) [0234.191] _vsnwprintf (in: _Buffer=0x138d5c0, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0x138cf88 | out: _Buffer="0F8BFBFF00050654") returned 16 [0234.194] lstrlenW (lpString=" 0") returned 2 [0234.194] lstrlenW (lpString="Intel(R) Xeon(R) Gold 6126 CPU @ 2.60GHz") returned 40 [0234.195] lstrlenW (lpString="") returned 0 [0234.195] lstrlenW (lpString="") returned 0 [0234.196] lstrlenW (lpString="") returned 0 [0234.199] IsProcessorFeaturePresent (ProcessorFeature=0x14) returned 1 [0234.200] IsProcessorFeaturePresent (ProcessorFeature=0x15) returned 1 [0234.202] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1 [0234.202] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1 [0234.202] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1 [0234.202] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1 [0234.202] _vsnwprintf (in: _Buffer=0x138d880, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x138d7c8 | out: _Buffer="CPU0") returned 4 [0234.204] free (_Block=0xdb3a20) [0234.204] free (_Block=0xddfbf0) [0234.204] free (_Block=0xddfe70) [0234.204] free (_Block=0xdb3ab0) [0234.205] free (_Block=0xde10a0) [0234.495] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0234.495] LoadLibraryExA (lpLibFileName="IPHLPAPI.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0234.500] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdaptersAddresses") returned 0x7ffda17d2a20 [0234.501] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x138d8e0 | out: lpflOldProtect=0x138d8e0*=0x4) returned 1 [0234.501] GetAdaptersAddresses (in: Family=0x0, Flags=0x0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x138d9b8*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x138d9b8*=0x1128) returned 0x6f [0234.553] malloc (_Size=0x1128) returned 0xdb65e0 [0234.554] GetAdaptersAddresses (in: Family=0x0, Flags=0x0, Reserved=0x0, AdapterAddresses=0xdb65e0, SizePointer=0x138d9b8*=0x1128 | out: AdapterAddresses=0xdb65e0*(Alignment=0x7000001c0, Length=0x1c0, IfIndex=0x7, Next=0xdb6ba0, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0xdb6850, FirstAnycastAddress=0x0, FirstMulticastAddress=0xdb6900, FirstDnsServerAddress=0xdb6b70, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x58, [1]=0xbc, [2]=0x27, [3]=0xf7, [4]=0xcc, [5]=0x54, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x7, ZoneIndices=([0]=0x7, [1]=0x7, [2]=0x7, [3]=0x7, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0xdb67a0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x138d9b8*=0x1128) returned 0x0 [0234.564] malloc (_Size=0x68) returned 0xdb0110 [0234.564] memcpy (in: _Dst=0xdb015c, _Src=0xdb6630, _Size=0x6 | out: _Dst=0xdb015c) returned 0xdb015c [0234.564] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0234.565] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetIpForwardTable2") returned 0x7ffda17da540 [0234.565] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x138d850 | out: lpflOldProtect=0x138d850*=0x4) returned 1 [0234.565] GetIpForwardTable2 () returned 0x0 [0234.567] malloc (_Size=0x20) returned 0xdb5e20 [0234.567] RtlIpv6AddressToStringW () returned 0x138d812 [0234.567] malloc (_Size=0x20) returned 0xdb6360 [0234.567] RtlIpv4AddressToStringW () returned 0x138d7fa [0234.568] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0234.568] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="ConvertLengthToIpv4Mask") returned 0x7ffda17d1c40 [0234.568] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x138d740 | out: lpflOldProtect=0x138d740*=0x4) returned 1 [0234.568] ConvertLengthToIpv4Mask (in: MaskLength=0x18, Mask=0x138d7c8 | out: Mask=0x138d7c8) returned 0x0 [0234.568] RtlIpv4AddressToStringW () returned 0x138d7fa [0234.568] malloc (_Size=0x20) returned 0xdb6060 [0234.569] RtlIpv4AddressToStringW () returned 0x138d7f6 [0234.569] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0234.569] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="FreeMibTable") returned 0x7ffda17d2840 [0234.569] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x138d850 | out: lpflOldProtect=0x138d850*=0x4) returned 1 [0234.569] FreeMibTable () returned 0x1 [0234.569] malloc (_Size=0x68) returned 0xdb0490 [0234.570] GetIpForwardTable2 () returned 0x0 [0234.570] malloc (_Size=0x20) returned 0xdb63c0 [0234.570] RtlIpv6AddressToStringW () returned 0x138d7e6 [0234.570] malloc (_Size=0x20) returned 0xdb60c0 [0234.570] RtlIpv4AddressToStringW () returned 0x138d7f2 [0234.570] ConvertLengthToIpv4Mask (in: MaskLength=0x8, Mask=0x138d7c8 | out: Mask=0x138d7c8) returned 0x0 [0234.575] RtlIpv4AddressToStringW () returned 0x138d7f2 [0234.575] FreeMibTable () returned 0x1 [0234.575] malloc (_Size=0x68) returned 0xdafee0 [0234.576] malloc (_Size=0x68) returned 0xdb78b0 [0234.576] memcpy (in: _Dst=0xdb78fc, _Src=0xdb7378, _Size=0x8 | out: _Dst=0xdb78fc) returned 0xdb78fc [0234.576] GetIpForwardTable2 () returned 0x0 [0234.577] malloc (_Size=0x20) returned 0xdb61b0 [0234.577] RtlIpv6AddressToStringW () returned 0x138d828 [0234.577] malloc (_Size=0x20) returned 0xdb6480 [0234.577] RtlIpv6AddressToStringW () returned 0x138d812 [0234.577] malloc (_Size=0x20) returned 0xdb6330 [0234.577] RtlIpv6AddressToStringW () returned 0x138d7e4 [0234.577] FreeMibTable () returned 0x1 [0234.578] free (_Block=0xdb65e0) [0234.579] _vsnwprintf (in: _Buffer=0x138d6f0, _BufferCount=0x105, _Format="SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}", _ArgList=0x138c708 | out: _Buffer="SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}") returned 77 [0234.581] _wtol (_String="0000") returned 0 [0234.597] malloc (_Size=0x48) returned 0xddfd30 [0234.601] _wtol (_String="0001") returned 1 [0234.605] malloc (_Size=0x48) returned 0xddfbf0 [0234.607] _wtol (_String="0002") returned 2 [0234.610] malloc (_Size=0x48) returned 0xddfa60 [0234.611] _wtol (_String="0003") returned 3 [0234.613] malloc (_Size=0x48) returned 0xddfc90 [0234.614] _wtol (_String="0004") returned 4 [0234.621] malloc (_Size=0x48) returned 0xddfdd0 [0234.622] _wtol (_String="0005") returned 5 [0234.624] malloc (_Size=0x48) returned 0xddfe20 [0234.628] _wtol (_String="Configuration") returned 0 [0234.630] _wtol (_String="Properties") returned 0 [0234.653] QueryDosDeviceW (in: lpDeviceName="{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", lpTargetPath=0x138c410, ucchMax=0x200 | out: lpTargetPath="뤁￿") returned 0x0 [0234.653] GetLastError () returned 0x2 [0234.654] DefineDosDeviceW (dwFlags=0x1, lpDeviceName="{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", lpTargetPath="\\Device\\{017EF944-8C88-42C3-8F92-C8F7B6022F8D}") returned 1 [0234.663] CreateFileW (lpFileName="\\\\.\\{017EF944-8C88-42C3-8F92-C8F7B6022F8D}" (normalized: "{017ef944-8c88-42c3-8f92-c8f7b6022f8d}"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0xffffffffffffffff [0234.664] DefineDosDeviceW (dwFlags=0x7, lpDeviceName="{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", lpTargetPath="\\Device\\{017EF944-8C88-42C3-8F92-C8F7B6022F8D}") returned 1 [0234.669] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0234.670] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0234.670] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", IfIndex=0x138d980 | out: IfIndex=0x138d980) returned 0x0 [0234.671] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0234.671] QueryDosDeviceW (in: lpDeviceName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", lpTargetPath=0x138c410, ucchMax=0x200 | out: lpTargetPath="") returned 0x0 [0234.671] GetLastError () returned 0x2 [0234.671] DefineDosDeviceW (dwFlags=0x1, lpDeviceName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", lpTargetPath="\\Device\\{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}") returned 1 [0234.676] CreateFileW (lpFileName="\\\\.\\{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}" (normalized: "{e25a642b-6ceb-4194-8f83-8bc82af94f5a}"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0xffffffffffffffff [0234.677] DefineDosDeviceW (dwFlags=0x7, lpDeviceName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", lpTargetPath="\\Device\\{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}") returned 1 [0234.679] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0234.680] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0234.680] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", IfIndex=0x138d980 | out: IfIndex=0x138d980) returned 0x0 [0234.680] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0234.681] QueryDosDeviceW (in: lpDeviceName="{9E8A7ED5-49C8-421B-A782-D46C28931105}", lpTargetPath=0x138c410, ucchMax=0x200 | out: lpTargetPath="\\Device\\NDMP7") returned 0xf [0234.681] CreateFileW (lpFileName="\\\\.\\{9E8A7ED5-49C8-421B-A782-D46C28931105}" (normalized: "\\device\\ndmp7"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0x464 [0234.681] DeviceIoControl (in: hDevice=0x464, dwIoControlCode=0x170002, lpInBuffer=0x138c870*, nInBufferSize=0x4, lpOutBuffer=0x138c8b0, nOutBufferSize=0x1000, lpBytesReturned=0x138c874, lpOverlapped=0x0 | out: lpInBuffer=0x138c870*, lpOutBuffer=0x138c8b0*, lpBytesReturned=0x138c874*=0x4, lpOverlapped=0x0) returned 1 [0234.682] DeviceIoControl (in: hDevice=0x464, dwIoControlCode=0x170002, lpInBuffer=0x138c870*, nInBufferSize=0x4, lpOutBuffer=0x138c8b0, nOutBufferSize=0x1000, lpBytesReturned=0x138c874, lpOverlapped=0x0 | out: lpInBuffer=0x138c870*, lpOutBuffer=0x138c8b0*, lpBytesReturned=0x138c874*=0xc, lpOverlapped=0x0) returned 1 [0234.682] CloseHandle (hObject=0x464) returned 1 [0234.683] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0234.684] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0234.684] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{9E8A7ED5-49C8-421B-A782-D46C28931105}", IfIndex=0x138d980 | out: IfIndex=0x138d980) returned 0x0 [0234.684] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0234.685] QueryDosDeviceW (in: lpDeviceName="{C2998852-8A8B-426B-AAB1-8880E47F8B1A}", lpTargetPath=0x138c410, ucchMax=0x200 | out: lpTargetPath="\\Device\\NDMP6") returned 0xf [0234.685] CreateFileW (lpFileName="\\\\.\\{C2998852-8A8B-426B-AAB1-8880E47F8B1A}" (normalized: "\\device\\ndmp6"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0x464 [0234.685] DeviceIoControl (in: hDevice=0x464, dwIoControlCode=0x170002, lpInBuffer=0x138c870*, nInBufferSize=0x4, lpOutBuffer=0x138c8b0, nOutBufferSize=0x1000, lpBytesReturned=0x138c874, lpOverlapped=0x0 | out: lpInBuffer=0x138c870*, lpOutBuffer=0x138c8b0*, lpBytesReturned=0x138c874*=0x4, lpOverlapped=0x0) returned 1 [0234.685] DeviceIoControl (in: hDevice=0x464, dwIoControlCode=0x170002, lpInBuffer=0x138c870*, nInBufferSize=0x4, lpOutBuffer=0x138c8b0, nOutBufferSize=0x1000, lpBytesReturned=0x138c874, lpOverlapped=0x0 | out: lpInBuffer=0x138c870*, lpOutBuffer=0x138c8b0*, lpBytesReturned=0x138c874*=0x20, lpOverlapped=0x0) returned 1 [0234.685] CloseHandle (hObject=0x464) returned 1 [0234.687] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0234.687] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0234.687] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{C2998852-8A8B-426B-AAB1-8880E47F8B1A}", IfIndex=0x138d980 | out: IfIndex=0x138d980) returned 0x0 [0234.687] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0234.688] QueryDosDeviceW (in: lpDeviceName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", lpTargetPath=0x138c410, ucchMax=0x200 | out: lpTargetPath="\\Device\\NDMP4") returned 0xf [0234.688] CreateFileW (lpFileName="\\\\.\\{E96D977E-F067-4CE9-924D-F6E0A04729E4}" (normalized: "\\device\\ndmp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0x464 [0234.688] DeviceIoControl (in: hDevice=0x464, dwIoControlCode=0x170002, lpInBuffer=0x138c870*, nInBufferSize=0x4, lpOutBuffer=0x138c8b0, nOutBufferSize=0x1000, lpBytesReturned=0x138c874, lpOverlapped=0x0 | out: lpInBuffer=0x138c870*, lpOutBuffer=0x138c8b0*, lpBytesReturned=0x138c874*=0x4, lpOverlapped=0x0) returned 1 [0234.688] DeviceIoControl (in: hDevice=0x464, dwIoControlCode=0x170002, lpInBuffer=0x138c870*, nInBufferSize=0x4, lpOutBuffer=0x138c8b0, nOutBufferSize=0x1000, lpBytesReturned=0x138c874, lpOverlapped=0x0 | out: lpInBuffer=0x138c870*, lpOutBuffer=0x138c8b0*, lpBytesReturned=0x138c874*=0x6, lpOverlapped=0x0) returned 1 [0234.689] CloseHandle (hObject=0x464) returned 1 [0234.690] malloc (_Size=0x18) returned 0xdb5230 [0234.691] malloc (_Size=0x18) returned 0xdb5270 [0234.691] SafeArrayPutElement (psa=0x53efd0, rgIndices=0x138d570, pv=0x542e38) returned 0x0 [0234.691] malloc (_Size=0x18) returned 0xdb5390 [0234.691] SafeArrayPutElement (psa=0x53f290, rgIndices=0x138d570, pv=0x53ecc8) returned 0x0 [0234.691] free (_Block=0xdb5390) [0234.691] free (_Block=0xdb5270) [0234.691] malloc (_Size=0x18) returned 0xdb5790 [0234.691] SafeArrayPutElement (psa=0x53efd0, rgIndices=0x138d570, pv=0x542e38) returned 0x0 [0234.691] malloc (_Size=0x18) returned 0xdb5470 [0234.691] SafeArrayPutElement (psa=0x53f290, rgIndices=0x138d570, pv=0x4dbdc8) returned 0x0 [0234.691] free (_Block=0xdb5470) [0234.691] free (_Block=0xdb5790) [0234.691] free (_Block=0xdb5230) [0234.692] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0234.693] GetProcAddress (hModule=0x7ffda8cc0000, lpProcName=0x10) returned 0x7ffda8cd0e10 [0234.693] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x138d420 | out: lpflOldProtect=0x138d420*=0x4) returned 1 [0234.693] malloc (_Size=0x18) returned 0xdb54d0 [0234.693] SafeArrayPutElement (psa=0x53f050, rgIndices=0x138d570, pv=0x4dbdc8) returned 0x0 [0234.693] SafeArrayPutElement (psa=0x53e810, rgIndices=0x138d570, pv=0xdb607c) returned 0x0 [0234.693] free (_Block=0xdb54d0) [0234.694] _wtol (_String="1650995052") returned 1650995052 [0234.694] _wtol (_String="1650991452") returned 1650991452 [0234.698] GetProcessHeap () returned 0x470000 [0234.698] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1c0) returned 0xef42f0 [0234.698] GetAdaptersAddresses (in: Family=0x0, Flags=0x6f, Reserved=0x0, AdapterAddresses=0xef42f0, SizePointer=0x138d0c0*=0x1c0 | out: AdapterAddresses=0xef42f0*(Alignment=0x0, Length=0x0, IfIndex=0x0, Next=0x0, AdapterName=0x0, FirstUnicastAddress=0x0, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix=0x0, Description=0x0, FriendlyName=0x0, PhysicalAddress=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x0, Flags=0x0, DdnsEnabled=0x0, RegisterAdapterSuffix=0x0, Dhcpv4Enabled=0x0, ReceiveOnly=0x0, NoMulticast=0x0, Ipv6OtherStatefulConfig=0x0, NetbiosOverTcpipEnabled=0x0, Ipv4Enabled=0x0, Ipv6Enabled=0x0, Ipv6ManagedAddressConfigurationSupported=0x0, Mtu=0x0, IfType=0x0, OperStatus=0x0, Ipv6IfIndex=0x0, ZoneIndices=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0), FirstPrefix=0x0, TransmitLinkSpeed=0x0, ReceiveLinkSpeed=0x0, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0x0, Ipv6Metric=0x0, Luid=0x0, Dhcpv4Server.lpSockaddr=0x0, Dhcpv4Server.iSockaddrLength=0, CompartmentId=0x0, NetworkGuid=0x0, ConnectionType=0x0, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0x0, Dhcpv6Iaid=0x0, FirstDnsSuffix=0x0), SizePointer=0x138d0c0*=0x9a8) returned 0x6f [0234.706] GetProcessHeap () returned 0x470000 [0234.706] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0xef42f0) returned 1 [0234.706] GetProcessHeap () returned 0x470000 [0234.707] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x9a8) returned 0x56e180 [0234.707] GetAdaptersAddresses (in: Family=0x0, Flags=0x6f, Reserved=0x0, AdapterAddresses=0x56e180, SizePointer=0x138d0c0*=0x9a8 | out: AdapterAddresses=0x56e180*(Alignment=0x7000001c0, Length=0x1c0, IfIndex=0x7, Next=0x56e3f0, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x0, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x58, [1]=0xbc, [2]=0x27, [3]=0xf7, [4]=0xcc, [5]=0x54, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x7, ZoneIndices=([0]=0x7, [1]=0x7, [2]=0x7, [3]=0x7, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x56e340*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x138d0c0*=0x9a8) returned 0x0 [0234.712] GetProcessHeap () returned 0x470000 [0234.712] RtlFreeHeap (HeapHandle=0x470000, Flags=0x0, BaseAddress=0x56e180) returned 1 [0234.714] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0234.714] LoadLibraryExA (lpLibFileName="DNSAPI.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda6620000 [0234.720] GetProcAddress (hModule=0x7ffda6620000, lpProcName="DnsQueryConfigAllocEx") returned 0x7ffda6626cf0 [0234.720] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x138d4f0 | out: lpflOldProtect=0x138d4f0*=0x4) returned 1 [0234.720] DnsQueryConfigAllocEx () returned 0xef37b0 [0234.725] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0234.725] GetProcAddress (hModule=0x7ffda6620000, lpProcName="DnsFreeConfigStructure") returned 0x7ffda665c9a0 [0234.725] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x138d4f0 | out: lpflOldProtect=0x138d4f0*=0x4) returned 1 [0234.725] DnsFreeConfigStructure () returned 0x1 [0234.726] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffd8ee77f20 | out: lpflOldProtect=0x7ffd8ee77f20*=0x2) returned 1 [0234.726] GetProcAddress (hModule=0x7ffda6620000, lpProcName="DnsQueryConfigDword") returned 0x7ffda6626bc0 [0234.726] VirtualProtect (in: lpAddress=0x7ffd8ee8a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x138d4f0 | out: lpflOldProtect=0x138d4f0*=0x4) returned 1 [0234.727] DnsQueryConfigDword () returned 0x1 [0234.727] DnsQueryConfigDword () returned 0x0 [0234.727] malloc (_Size=0x18) returned 0xdb5810 [0234.727] SafeArrayPutElement (psa=0x53e910, rgIndices=0x138d280, pv=0x4dbdc8) returned 0x0 [0234.728] free (_Block=0xdb5810) [0234.729] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0234.730] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0234.731] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{E96D977E-F067-4CE9-924D-F6E0A04729E4}", IfIndex=0x138d980 | out: IfIndex=0x138d980) returned 0x0 [0234.732] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0234.733] QueryDosDeviceW (in: lpDeviceName="{E4D2000A-6025-4C58-8789-AF7349886E11}", lpTargetPath=0x138c410, ucchMax=0x200 | out: lpTargetPath="") returned 0x0 [0234.733] GetLastError () returned 0x2 [0234.733] DefineDosDeviceW (dwFlags=0x1, lpDeviceName="{E4D2000A-6025-4C58-8789-AF7349886E11}", lpTargetPath="\\Device\\{E4D2000A-6025-4C58-8789-AF7349886E11}") returned 1 [0234.738] CreateFileW (lpFileName="\\\\.\\{E4D2000A-6025-4C58-8789-AF7349886E11}" (normalized: "{e4d2000a-6025-4c58-8789-af7349886e11}"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0xffffffffffffffff [0234.739] DefineDosDeviceW (dwFlags=0x7, lpDeviceName="{E4D2000A-6025-4C58-8789-AF7349886E11}", lpTargetPath="\\Device\\{E4D2000A-6025-4C58-8789-AF7349886E11}") returned 1 [0234.740] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffda17d0000 [0234.741] GetProcAddress (hModule=0x7ffda17d0000, lpProcName="GetAdapterIndex") returned 0x7ffda17eddb0 [0234.741] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{E4D2000A-6025-4C58-8789-AF7349886E11}", IfIndex=0x138d980 | out: IfIndex=0x138d980) returned 0x0 [0234.741] FreeLibrary (hLibModule=0x7ffda17d0000) returned 1 [0234.742] free (_Block=0xddfd30) [0234.743] free (_Block=0xddfbf0) [0234.745] free (_Block=0xddfa60) [0234.746] free (_Block=0xddfc90) [0234.747] free (_Block=0xddfdd0) [0234.748] free (_Block=0xddfe20) [0234.749] free (_Block=0xdb5e20) [0234.749] free (_Block=0xdb6360) [0234.750] free (_Block=0xdb6060) [0234.753] free (_Block=0xdb0110) [0234.754] free (_Block=0xdb63c0) [0234.754] free (_Block=0xdb60c0) [0234.754] free (_Block=0xdb0490) [0234.755] free (_Block=0xdafee0) [0234.755] free (_Block=0xdb61b0) [0234.755] free (_Block=0xdb6480) [0234.756] free (_Block=0xdb6330) [0234.756] free (_Block=0xdb78b0) [0244.687] malloc (_Size=0x600) returned 0xdb65e0 [0244.687] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0x138d7f8 | out: Buffer=0x0, ReturnedLength=0x138d7f8) returned 0 [0244.687] GetLastError () returned 0x7a [0244.687] malloc (_Size=0x250) returned 0xdb3ab0 [0244.687] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0xdb3ab0, ReturnedLength=0x138d7f8 | out: Buffer=0xdb3ab0, ReturnedLength=0x138d7f8) returned 1 [0244.687] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4 [0244.687] GetMaximumProcessorGroupCount () returned 0x1 [0244.688] malloc (_Size=0x40) returned 0xddff10 [0244.688] malloc (_Size=0x40) returned 0xddfbf0 [0244.688] malloc (_Size=0x8) returned 0xdb39c0 [0244.688] memcpy (in: _Dst=0xddff10, _Src=0xdb3ad0, _Size=0x10 | out: _Dst=0xddff10) returned 0xddff10 [0244.689] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4 [0244.689] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0x138d7f0, InputBufferLength=0x2, OutputBuffer=0xdb65e0, OutputBufferLength=0x60 | out: OutputBuffer=0xdb65e0) returned 0x0 [0244.689] _vsnwprintf (in: _Buffer=0x138d690, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x138cf88 | out: _Buffer="CPU0") returned 4 [0244.690] GetCurrentThread () returned 0xfffffffffffffffe [0244.690] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x138cee0, PreviousGroupAffinity=0x138cef0 | out: PreviousGroupAffinity=0x138cef0) returned 1 [0244.690] GetSystemInfo (in: lpSystemInfo=0x138d020 | out: lpSystemInfo=0x138d020*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0244.690] mbstowcs (in: _Dest=0x138d2a8, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc [0244.690] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0 [0244.692] mbstowcs (in: _Dest=0x138d118, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27 [0244.692] GetCurrentThread () returned 0xfffffffffffffffe [0244.692] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x138cef0, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1 [0244.693] LoadStringW (in: hInstance=0x7ffd8ecc0000, uID=0x2c, lpBuffer=0x138ccf0, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6 [0244.759] malloc (_Size=0x34c34) returned 0xde0090 [0244.780] _wtoi (_String="238") returned 238 [0244.780] _wtoi (_String="6") returned 6 [0244.780] _itow (in: _Dest=0x0, _Radix=20501952 | out: _Dest=0x0) returned="0" [0244.780] _itow (in: _Dest=0xee, _Radix=20500240 | out: _Dest=0xee) returned="238" [0244.780] malloc (_Size=0x4000) returned 0xe14cd0 [0244.780] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe14cd0, lpcbData=0x138cee4*=0x4000 | out: lpType=0x0, lpData=0xe14cd0*=0x50, lpcbData=0x138cee4*=0x600) returned 0x0 [0244.782] free (_Block=0xe14cd0) [0244.783] Sleep (dwMilliseconds=0x3e8) [0245.783] _itow (in: _Dest=0xee, _Radix=20500240 | out: _Dest=0xee) returned="238" [0245.784] malloc (_Size=0x4000) returned 0xe14cd0 [0245.784] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe14cd0, lpcbData=0x138cee4*=0x4000 | out: lpType=0x0, lpData=0xe14cd0*=0x50, lpcbData=0x138cee4*=0x600) returned 0x0 [0245.785] free (_Block=0xe14cd0) [0245.787] free (_Block=0xde0090) [0245.788] _vsnwprintf (in: _Buffer=0x138d5c0, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0x138cf88 | out: _Buffer="0F8BFBFF00050654") returned 16 [0245.788] lstrlenW (lpString=" 0") returned 2 [0245.788] lstrlenW (lpString="Intel(R) Xeon(R) Gold 6126 CPU @ 2.60GHz") returned 40 [0245.788] lstrlenW (lpString="") returned 0 [0245.788] lstrlenW (lpString="") returned 0 [0245.788] lstrlenW (lpString="") returned 0 [0245.788] IsProcessorFeaturePresent (ProcessorFeature=0x14) returned 1 [0245.788] IsProcessorFeaturePresent (ProcessorFeature=0x15) returned 1 [0245.789] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1 [0245.789] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1 [0245.789] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1 [0245.789] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1 [0245.789] _vsnwprintf (in: _Buffer=0x138d880, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x138d7c8 | out: _Buffer="CPU0") returned 4 [0245.789] free (_Block=0xdb39c0) [0245.789] free (_Block=0xddfbf0) [0245.790] free (_Block=0xddff10) [0245.790] free (_Block=0xdb3ab0) [0245.790] free (_Block=0xdb65e0) [0246.090] malloc (_Size=0x600) returned 0xdb65e0 [0246.090] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0x138d7f8 | out: Buffer=0x0, ReturnedLength=0x138d7f8) returned 0 [0246.090] GetLastError () returned 0x7a [0246.090] malloc (_Size=0x250) returned 0xdb3ab0 [0246.090] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0xdb3ab0, ReturnedLength=0x138d7f8 | out: Buffer=0xdb3ab0, ReturnedLength=0x138d7f8) returned 1 [0246.090] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4 [0246.090] GetMaximumProcessorGroupCount () returned 0x1 [0246.090] malloc (_Size=0x40) returned 0xddfa60 [0246.090] malloc (_Size=0x40) returned 0xddfd30 [0246.090] malloc (_Size=0x8) returned 0xdb39c0 [0246.090] memcpy (in: _Dst=0xddfa60, _Src=0xdb3ad0, _Size=0x10 | out: _Dst=0xddfa60) returned 0xddfa60 [0246.090] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4 [0246.090] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0x138d7f0, InputBufferLength=0x2, OutputBuffer=0xdb65e0, OutputBufferLength=0x60 | out: OutputBuffer=0xdb65e0) returned 0x0 [0246.090] _vsnwprintf (in: _Buffer=0x138d690, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x138cf88 | out: _Buffer="CPU0") returned 4 [0246.090] GetCurrentThread () returned 0xfffffffffffffffe [0246.090] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x138cee0, PreviousGroupAffinity=0x138cef0 | out: PreviousGroupAffinity=0x138cef0) returned 1 [0246.091] GetSystemInfo (in: lpSystemInfo=0x138d020 | out: lpSystemInfo=0x138d020*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0246.091] mbstowcs (in: _Dest=0x138d2a8, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc [0246.091] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0 [0246.092] mbstowcs (in: _Dest=0x138d118, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27 [0246.092] GetCurrentThread () returned 0xfffffffffffffffe [0246.092] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x138cef0, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1 [0246.092] LoadStringW (in: hInstance=0x7ffd8ecc0000, uID=0x2c, lpBuffer=0x138ccf0, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6 [0246.144] malloc (_Size=0x34c34) returned 0xde0090 [0246.154] _wtoi (_String="238") returned 238 [0246.154] _wtoi (_String="6") returned 6 [0246.154] _itow (in: _Dest=0x0, _Radix=20501952 | out: _Dest=0x0) returned="0" [0246.154] _itow (in: _Dest=0xee, _Radix=20500240 | out: _Dest=0xee) returned="238" [0246.154] malloc (_Size=0x4000) returned 0xe14cd0 [0246.155] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe14cd0, lpcbData=0x138cee4*=0x4000 | out: lpType=0x0, lpData=0xe14cd0*=0x50, lpcbData=0x138cee4*=0x600) returned 0x0 [0246.156] free (_Block=0xe14cd0) [0246.157] Sleep (dwMilliseconds=0x3e8) [0247.159] _itow (in: _Dest=0xee, _Radix=20500240 | out: _Dest=0xee) returned="238" [0247.159] malloc (_Size=0x4000) returned 0xe14cd0 [0247.159] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe14cd0, lpcbData=0x138cee4*=0x4000 | out: lpType=0x0, lpData=0xe14cd0*=0x50, lpcbData=0x138cee4*=0x600) returned 0x0 [0247.161] free (_Block=0xe14cd0) [0247.163] free (_Block=0xde0090) [0247.164] _vsnwprintf (in: _Buffer=0x138d5c0, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0x138cf88 | out: _Buffer="0F8BFBFF00050654") returned 16 [0247.164] lstrlenW (lpString=" 0") returned 2 [0247.164] lstrlenW (lpString="Intel(R) Xeon(R) Gold 6126 CPU @ 2.60GHz") returned 40 [0247.164] lstrlenW (lpString="") returned 0 [0247.164] lstrlenW (lpString="") returned 0 [0247.164] lstrlenW (lpString="") returned 0 [0247.165] IsProcessorFeaturePresent (ProcessorFeature=0x14) returned 1 [0247.165] IsProcessorFeaturePresent (ProcessorFeature=0x15) returned 1 [0247.165] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1 [0247.165] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1 [0247.165] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1 [0247.165] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1 [0247.165] _vsnwprintf (in: _Buffer=0x138d880, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x138d7c8 | out: _Buffer="CPU0") returned 4 [0247.166] free (_Block=0xdb39c0) [0247.166] free (_Block=0xddfd30) [0247.172] free (_Block=0xddfa60) [0247.172] free (_Block=0xdb3ab0) [0247.173] free (_Block=0xdb65e0) Thread: id = 115 os_tid = 0xbb8 Thread: id = 116 os_tid = 0xe3c Thread: id = 117 os_tid = 0xe34 [0261.757] DllCanUnloadNow () returned 0x1 Thread: id = 118 os_tid = 0xe30 Thread: id = 119 os_tid = 0xe1c Thread: id = 133 os_tid = 0x1344